A vulnerability has been found in Glances which may lead to arbitrary code execution.

Announced

2024-02-26

Revised

2024-02-26

Access

remote

Bugs

#791565

Advisory

https://security.gentoo.org/glsa/202402-30

Affected packages

Package	Arch	Vulnerable	Unaffected
sys-process/glances	*	< 3.1.7	>= 3.1.7

Background

Glances is an open-source system cross-platform monitoring tool. It allows real-time monitoring of various aspects of your system such as CPU, memory, disk, network usage etc.

Description

A vulnerability in XML parsing may lead to a variety of XML attacks.

Impact

A vulnerability in XML parsing may lead to a variety of XML attacks.

Workaround

There is no known workaround at this time.

Resolution

All Glances users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-process/glances-3.1.7"