Fedora Core 3: 2005-403 Moderate: gedit Filename Structure Vulnerability

gEdit is a small but powerful text editor designed specifically for

the GNOME GUI desktop. gEdit includes a plug-in API (which supports

extensibility while keeping the core binary small), support for

editing multiple documents using notebook tabs, and standard text

editor functions.

You'll need to have GNOME and GTK+ installed to use gEdit.

An updated gedit package that fixes a file name format string vulnerability

is now available.

This update has been rated as having moderate security impact by the Red

Hat Security Response Team gEdit is a small text editor designed specifically for the GNOME GUI desktop.

A file name format string vulnerability has been discovered in gEdit. It is

possible for an attacker to create a file with a carefully crafted name

which, when the file is opened, executes arbitrary instructions on a

victim's machine. Although it is unlikely that a user would manually open a

file with such a carefully crafted file name, a user could, for example, be

tricked into opening such a file from within an email client. The Common

Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name

CAN-2005-1686 to this issue.

Users of gEdit should upgrade to this updated package, which contains a

backported patch to correct this issue.

- Dont pass user input as format specifiers to

gtk_message_dialog_new (bug 159657).

0cda03e960fa2a10affb26df06a137c8 SRPMS/gedit-2.8.1-2.fc3.1.src.rpm

e17d271ac464e23edd551516afae1c7f x86_64/gedit-2.8.1-2.fc3.1.x86_64.rpm

e0c4cd2e6cfbd7c089521acae61e9320 x86_64/gedit-devel-2.8.1-2.fc3.1.x86_64.rpm

462896c74e203ef95b002f649cbee289 x86_64/debug/gedit-debuginfo-2.8.1-2.fc3.1.x86_64.rpm

c95bab56d29eed0c5320ada147fba03d i386/gedit-2.8.1-2.fc3.1.i386.rpm

d4d49f857df7b492cd45f00d9f06efda i386/gedit-devel-2.8.1-2.fc3.1.i386.rpm

72902a585ff2c43b57840b24d1868ecc i386/debug/gedit-debuginfo-2.8.1-2.fc3.1.i386.rpm

This update can also be installed with the Update Agent; you can

launch the Update Agent with the 'up2date' command.

out. Sorry for the delay.

Ray Strode

--fedora-announce-list mailing list

fedora-announce-list@redhat.com