MDKSA-2002:054-1
- Package name
- gaim
- Date
- 2002-09-05
- Advisory ID
- MDKSA-2002:054-1
- Affected versions
- 8.1 i586
Problem description
Versions of Gaim (an AOL instant message client) prior to 0.58 contain a buffer overflow in the Jabber plug-in module. As well, a vulnerability was discovered in the URL-handling code, where the "manual" browser command passes an untrusted string to the shell without reliable quoting or escaping. This allows an attacker to execute arbitrary commands on the user's machine with the user's permissions. Those using the built-in browser commands are not vulnerable. Update: The 8.1 package had an incorrect dependency on perl. This package has been replaced with a proper package. Please note the differing md5 sums.
Updated packages
8.1 i586
b6438c115a3cfa04c891e082c0795956 8.1/RPMS/gaim-0.59.1-1.1mdk.i586.rpm d72cf5a2ccfa4d130b036aeac5fd88f4 8.1/SRPMS/gaim-0.59.1-1.1mdk.src.rpm