GNU Midnight Commander does not properly sanitize environment variables, possibly resulting in execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-misc/mc | * | < 4.8.7 | >= 4.8.7 |
GNU Midnight Commander is a text based file manager.
GNU Midnight Commander does not properly sanitize environment variables.
A remote attacker could entice a user to open a specially crafted archive file using GNU Midnight Commander, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All GNU Midnight Commander users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-misc/mc-4.8.7"
Midnight Commander contains several format string errors, buffer overflows and one buffer underflow leading to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-misc/mc | * | < 4.6.0-r13 | >= 4.6.0-r13 |
Midnight Commander is a visual console file manager.
Midnight Commander contains several format string vulnerabilities (CAN-2004-1004), buffer overflows (CAN-2004-1005), a memory deallocation error (CAN-2004-1092) and a buffer underflow (CAN-2004-1176).
An attacker could exploit these vulnerabilities to execute arbitrary code with the permissions of the user running Midnight Commander or cause Denial of Service by freeing unallocated memory.
There is no known workaround at this time.
All Midnight Commander users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-misc/mc-4.6.0-r13"
Multiple security issues have been discovered in Midnight Commander including several buffer overflows and string format vulnerabilities.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-misc/mc | * | <= 4.6.0-r6 | >= 4.6.0-r7 |
Midnight Commander is a visual console file manager.
Numerous security issues have been discovered in Midnight Commander, including several buffer overflow vulnerabilities, multiple vulnerabilities in the handling of temporary file and directory creation, and multiple format string vulnerabilities.
The buffer overflows and format string vulnerabilities may allow attackers to cause a denial of service or execute arbitrary code with permissions of the user running MC. The insecure creation of temporary files and directories could lead to a privilege escalation, including root privileges, for a local attacker.
There is no known workaround at this time. All users are advised to upgrade to version 4.6.0-r7 or higher of Midnight Commander.
All Midnight Commander users should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=app-misc/mc-4.6.0-r7 # emerge ">=app-misc/mc-4.6.0-r7"
A remotely-exploitable buffer overflow in Midnight Commander allows arbitrary code to be run on a user's computer
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-misc/mc | * | <= 4.6.0-r4 | >= 4.6.0-r5 |
Midnight Commander is a visual file manager.
A stack-based buffer overflow has been found in Midnight Commander's virtual filesystem.
This overflow allows an attacker to run arbitrary code on the user's computer during the symlink conversion process.
While a workaround is not currently known for this issue, all users are advised to upgrade to the latest version of the affected package.
All users should upgrade to the current version of the affected package:
# emerge sync # emerge -pv ">=app-misc/mc-4.6.0-r5" # emerge ">=app-misc/mc-4.6.0-r5"