--nextPart9248865.5eBeqYSBJv
Content-Type: Text/Plain;
  charset="us-ascii
Content-Transfer-Encoding: quoted-printable

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201111-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal
    Title: abcm2ps: Multiple vulnerabilities
     Date: November 20, 2011
     Bugs: #322859
       ID: 201111-12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities, including buffer overflows, have been found
in abcm2ps.

Background
==========

abcm2ps is a program to convert abc files to Postscript files.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  media-sound/abcm2ps          < 5.9.13                  >= 5.9.13 

Description
===========

Multiple vulnerabilities have been discovered in abcm2ps:

* Boundary errors in the PUT0 and PUT1 macros, the trim_title()
  function, or a long "-O" command line option can lead to a buffer
  overflow (CVE-2010-3441).
* A vulnerability in the getarena() function in abc2ps.c can cause a
  heap-based buffer overflow in abcm2ps (CVE-2010-4743).
* Multiple unspecified vulnerabilities (CVE-2010-4744).

Impact
======

A remote attacker could entice a user to load a specially crafted ABC
file or use a long -O option on the command line, resulting in the
execution of arbitrary code.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All abcm2ps users should upgrade to the latest stable version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=media-sound/abcm2ps-5.9.13"

NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since August 27, 2010. It is likely that your system is
already no longer affected by this issue.

References
==========

[ 1 ] CVE-2010-3441
      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3441
[ 2 ] CVE-2010-4743
      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4743
[ 3 ] CVE-2010-4744
      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4744

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 http://security.gentoo.org/glsa/glsa-201111-12.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2011 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

--nextPart9248865.5eBeqYSBJv
Content-Type: application/pgp-signature; name=signature.asc 
Content-Description: This is a digitally signed message part.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (GNU/Linux)

iQIcBAABCAAGBQJOyUOrAAoJEDa6ZWES7jAAU4kQAJLFZTT6xw3spauivAQduQZe
IiRcD6gv7LZ0BmsROmqw9AlDi+F+Vd9wl9dTjFljhE24CbOrNBeRS3MXTFrOzYBX
7geM7mba0t3Urexgg3h0iH4GvQp2cc2nBicnDKQcH011WfZXeM6Mh26vzONpW8wZ
fdHpCXsxDqVlvQde7NLDx5D8q+W6yNRyoAuh1hoRgqW72a/60XZVocilZ/NPpU4w
CA2h0fWlTA7JUQ0T/yIX63GYby7nPe4SQ3W/ORQvZ1yenIQ1Bhv9TPgEja7UV+76
8O5NyCdAxVspMJZNVInygAes1jP7+VjFa00u82JsEJ5HJX2LlIQGPDmufxVquGGz
qyQayf9nRPqSN5EQRaZWqyx1rRthWBS0ezahU9PdRxi5AWTDMCrU9mBMPAC1qoB3
l4Qnuf1iWZ/gvXdwxaX+q8x1yNG4HxDySpQWfspfPl+RkpZHh+MzlQLW8WIawjxm
KG6RBnLGvGYq3wY/9vrRmEeSr20V/lwaPv8YjVANUG1tN+mHQFgvInCJ0u8z6DHa
RSghDAKNQmWhlMm2QxyarT3qZ8DdIlgMAiUQNUAdYt4GqGNvQUw1+8dYA2bfqhuU
SUae0GukswpGXpLkQUIA0HNMjY910rXT6ZQYXl5YkHxQunyvQEt2amKiPrUjHUfy
2jyI0imEwmG+UWLACfwJ
=nnNC
-----END PGP SIGNATURE-----

--nextPart9248865.5eBeqYSBJv--