--nextPart1347298.jVdF63BcBo
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

=2D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200904-02
=2D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/ 
=2D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: GLib: Execution of arbitrary code
      Date: April 03, 2009
      Bugs: #249214
        ID: 200904-02

=2D - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Multiple integer overflows might allow for the execution of arbitrary
code when performing base64 conversion.

Background
=========
The GLib is a library of C routines that is used by a multitude of
programs.

Affected packages
================
    -------------------------------------------------------------------
     Package        /   Vulnerable   /                      Unaffected
    -------------------------------------------------------------------
  1  dev-libs/glib      < 2.18.4-r1                       >= 2.18.4-r1
                                                         *>= 2.16.6-r1

Description
==========
Diego E. Petten=F2 reported multiple integer overflows in glib/gbase64.c
when converting a long string from or to a base64 representation.

Impact
=====
A remote attacker could entice a user or automated system to perform a
base64 conversion via an application using GLib, possibly resulting in
the execution of arbitrary code.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All GLib 2.18 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.18.4-r1"

All GLib 2.16 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-libs/glib-2.16.6-r1"

References
=========
  [ 1 ] CVE-2008-4316
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4316 

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200904-02.xml 

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at 
http://bugs.gentoo.org. 

License
======
Copyright 2009 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5 

--nextPart1347298.jVdF63BcBo
Content-Type: application/pgp-signature; name=signature.asc 
Content-Description: This is a digitally signed message part.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.10 (GNU/Linux)

iQIcBAABAgAGBQJJ1hOPAAoJECaaHo/OfoM52ckP/A38bbcWGp3eghvcws8wF7q9
m5eE15w8ucgwBapL8woh+JvBBINnOh2QW+sk68SC2SAfVeZPUW/s6oTTCHFAjw0l
bhrmbZV37ymiCevSR22QS5xaAnPiVpW8OJKe7WVOhq/jGVsB0KejDFFygBxYa9ql
f1u9+vF2fxK7MOJM2KKlyyips/5gHMdefpc5umAgUu7i4MDZPE9J6rKQROcNpHRn
rUUdayhHqFo0p4gGFrBvJptv1S1OeMC0LyRgdK7cMHahb8ZxaFXjKvtmQWmmD2XP
y/tVzZCa4Gf4ZMTenEwTbOJNuv6yhI5pEaN56NCzd4xUBTEUi9sKON/jcFzUw3zQ
Sgh1B58m7Q2XDmJTqb/OlQzVt63ulRBZyKuImHpmWblWfO0nI7iARNvRYmZCmCIK
gMBDsZ0Sc3RRbeT/3sT9J4xlsQl88K7r6bjIPCqOnbPy18fuo1OyEd/DJWqXqwgL
yPgRBj0wyOLeVhHJwHMhMytm3XemkfY7M8odQ98AU14Kqt5zZOxyVi7JMMvmbXRc
xoa0uOQxwlHCtuvi9Joqvx9Jz+yzI9CKclu5q38UYctF1DTWi2AdcPY65ruTwW6N
b2VCNqs3tfhCTsbKSereMicCAu5/72hFoKAksz8pzUhMKVCOf4D1y8X0VrSmSKAi
1CwmnVoD3HqKTmaZMQur
=dGH6
-----END PGP SIGNATURE-----

--nextPart1347298.jVdF63BcBo--