gnustep-base/gnustep-base-1.31.1-r1

portage-ng glsa

▸ GLSA 201412-20 GNUstep Base library: Denial of service this version unaffected normal remote 2014-12-13

A vulnerability in GNUstep Base library could lead to Denial of Service.

Announced: 2014-12-13
Revised: 2014-12-13
Access: remote
Bugs: #508370
Advisory: https://security.gentoo.org/glsa/201412-20

Affected packages

Package	Arch	Vulnerable	Unaffected
gnustep-base/gnustep-base	*	< 1.24.6-r1	>= 1.24.6-r1

Background

GNUstep Base library is a free software package implementing the API of the OpenStep Foundation Kit (tm), including later additions.

Description

GNUstep Base library does not properly handle the file descriptor for logging, when run as a daemon.

Impact

A remote attacker could send a specially crafted request, possibly resulting in a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All GNUstep Base library users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=gnustep-base/gnustep-base-1.24.6-r1"

References

CVE-2014-2980

▸ GLSA 201401-12 GNUstep Base library: Multiple vulnerabilities this version unaffected high local, remote 2014-01-20

Multiple vulnerabilities have been found in GNUstep Base library, the worst of which allow execution of arbitrary code.

Announced: 2014-01-20
Revised: 2014-01-20
Access: local, remote
Bugs: #325577
Advisory: https://security.gentoo.org/glsa/201401-12

Affected packages

Package	Arch	Vulnerable	Unaffected
gnustep-base/gnustep-base	*	< 1.20.1	>= 1.20.1

Background

GNUstep Base library is a free software package implementing the API of the OpenStep Foundation Kit (tm), including later additions.

Description

Multiple vulnerabilities have been discovered in GNUstep Base library. Please review the CVE identifiers referenced below for details.

Impact

A context-dependent attacker could possibly execute arbitrary code. A local attacker could possibly read arbitrary files.

Workaround

There is no known workaround at this time.

Resolution

All GNUstep Base library users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=gnustep-base/gnustep-base-1.20.1"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since August 13, 2010. It is likely that your system is already no longer affected by this issue.