GLSA: qt-dcgui

From: Daniel Ahlberg (aliz@gentoo.org)
Date: 02/04/03

  • Next message: delusion: "Re: PHP-Nuke Avatar Code injection vulnerability" 
    From: Daniel Ahlberg <aliz@gentoo.org>
Date: Tue, 4 Feb 2003 16:03:48 +0100
To: bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - --------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200302-03
    - - --------------------------------------------------------------------

    PACKAGE : qt-dcgui
    SUMMARY : file leaking
    DATE : 2003-02-04 15:03 UTC
    EXPLOIT : remote

    - - --------------------------------------------------------------------

    - From announcment:

    "All versions < 0.2.2 have a major security vulnerability in the
    directory parser. This bug allow a remote attacker to download files
    outside the sharelist. It's recommend that you upgrade the packages
    immediatly."
     
    Read the full announcment at:
    http://dc.ketelhot.de/pipermail/dc/2003-January/000094.html
     
    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    net-p2p/qt-dcgui upgrade to qt-dcgui-0.2.4 as follows:

    emerge sync
    emerge -u qt-dcgui
    emerge clean

    - - --------------------------------------------------------------------
    aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
    styx@gentoo.org
    - - --------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+P9ZJfT7nyhUpoZMRAtoYAJ45ZBiV/8y3CFmv+/UiHTHfN+q1rACfd7bf
    GxwCDv8PO1m17sJJMp33KfA=
    =2ZdT
    -----END PGP SIGNATURE-----