This is an OpenPGP/MIME signed message (RFC 2440 and 3156)

--------------enig30D97E36D2841A76847858D8

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 7bit



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory                           GLSA 200511-13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                            http://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



  Severity: Normal

     Title: Sylpheed, Sylpheed-Claws: Buffer overflow in LDIF importer

      Date: November 15, 2005

      Bugs: #111853

        ID: 200511-13



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Synopsis

========



Sylpheed and Sylpheed-Claws contain a buffer overflow vulnerability

which may lead to the execution of arbitrary code.



Background

==========



Sylpheed is a lightweight email client and newsreader. Sylpheed-Claws

is a 'bleeding edge' version of Sylpheed. They both support the import

of address books in LDIF (Lightweight Directory Interchange Format).



Affected packages

=================



    -------------------------------------------------------------------

     Package                     /  Vulnerable  /           Unaffected

    -------------------------------------------------------------------

  1  mail-client/sylpheed             < 2.0.4                 >= 2.0.4

  2  mail-client/sylpheed-claws     < 1.0.5-r1             >= 1.0.5-r1

    -------------------------------------------------------------------

     2 affected packages on all of their supported architectures.

    -------------------------------------------------------------------



Description

===========



Colin Leroy reported buffer overflow vulnerabilities in Sylpheed and

Sylpheed-Claws. The LDIF importer uses a fixed length buffer to store

data of variable length. Two similar problems exist also in the Mutt

and Pine addressbook importers of Sylpheed-Claws.



Impact

======



By convincing a user to import a specially-crafted LDIF file into the

address book, a remote attacker could cause the program to crash,

potentially allowing the execution of arbitrary code with the

privileges of the user running the software.



Workaround

==========



There is no known workaround at this time.



Resolution

==========



All Sylpheed users should upgrade to the latest version:



    # emerge --sync

    # emerge --ask --oneshot --verbose
 ">=mail-client/sylpheed-2.0.4"



All Sylpheed-Claws users should upgrade to the latest version:



    # emerge --sync

    # emerge --ask --oneshot --verbose

">=mail-client/sylpheed-claws-1.0.5-r1"



References

==========



  [ 1 ] CVE-2005-3354

        http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3354



Availability

============



This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:



  http://security.gentoo.org/glsa/glsa-200511-13.xml



Concerns?

=========



Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users machines is of utmost

importance to us. Any security concerns should be addressed to

security@gentoo.org or alternatively, you may file a bug at

http://bugs.gentoo.org.



License

=======



Copyright 2005 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).



The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.



http://creativecommons.org/licenses/by-sa/2.0





--------------enig30D97E36D2841A76847858D8

Content-Type: application/pgp-signature; name="signature.asc"

Content-Description: OpenPGP digital signature

Content-Disposition: attachment; filename="signature.asc"



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.1 (GNU/Linux)



iD8DBQFDeehuvcL1obalX08RAqZMAJ9clI0ds69XZAsK7l0S94FB8M/DFQCgjj1a

/8p6cQrJGD6VZ+p5GqXPt0w=

=QY/4

-----END PGP SIGNATURE-----



--------------enig30D97E36D2841A76847858D8--

-- 

gentoo-announce@gentoo.org mailing list