Stay Secure with the Latest Linux Advisories

security advisorymedium severityarbitrary code execution

Arch Linux: 202106-13 Medium Severity: Zint Arbitrary Code Execution

The package zint before version 2.9.1-2 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202106-13 ========================================= Severity: Medium Date : 2021-06-01 CVE-ID : CVE-2021-27799 Package : zint Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1625 Summary ====== The package zint before version 2.9.1-2 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 2.9.1-2. # pacman -Syu "zint> =2.9.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========= None. Description ========== ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API through an application that includes the Zint Barcode Generator library code. Impact ===== An attacker could execute arbitrary code by supplying crafted input to generate an EAN barcode. References ========= https://bugs.archlinux.org/task/70051 https://security.archlinux.org/CVE-2021-27799 . Debian Security Advisory DSA-2021-004 warns of a potential buffer overflow issue in curl package versions prior to v7.76.0.. Arch Linux Security Advisory, Zint Package Risk, Code Execution Threat. . Severity: Medium. LinuxSecurity.com Team

Jun 03, 2021 •Medium ArchLinux