Package name
dia
Date
2005-10-20
Advisory ID
MDKSA-2005:187
Affected versions
2006.0 i586 , 10.2 i586 , 10.2 x86_64 , 2006.0 x86_64

Problem description

Joxean Koret discovered that the Python SVG import plugin in dia, a vector-oriented diagram editor, does not properly sanitise data read from an SVG file and is hence vulnerable to execute arbitrary Python code. The updated packages have been patched to address this issue.

Updated packages

2006.0 i586

 f15f857ac65e4071d2a54a8037fce302  2006.0/RPMS/dia-0.94-6.1.20060mdk.i586.rpm
8e8d94c15c4eab00428ae0094f5512a5  2006.0/SRPMS/dia-0.94-6.1.20060mdk.src.rpm

10.2 i586

 0c8a73f7bd63bad23baaec2241b4423c  10.2/RPMS/dia-0.94-4.1.102mdk.i586.rpm
8e8d94c15c4eab00428ae0094f5512a5  10.2/SRPMS/dia-0.94-6.1.20060mdk.src.rpm

10.2 x86_64

 ac4d0bc7654a02cd150693c89d47654b  x86_64/10.2/RPMS/dia-0.94-4.1.102mdk.x86_64.rpm
8e8d94c15c4eab00428ae0094f5512a5  x86_64/10.2/SRPMS/dia-0.94-6.1.20060mdk.src.rpm

2006.0 x86_64

 394b409242bd4271c4cd0e22e86cdf5b  x86_64/2006.0/RPMS/dia-0.94-6.1.20060mdk.x86_64.rpm
8e8d94c15c4eab00428ae0094f5512a5  x86_64/2006.0/SRPMS/dia-0.94-6.1.20060mdk.src.rpm

References