Summary
The remote host is missing an update to xpcd
announced via advisory DSA 676-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20676-1
Insight
Erik Sjölund discovered a buffer overflow in pcdsvgaview, an SVGA PhotoCD viewer. xpcd-svga is part of xpcd and uses svgalib to display graphics on the Linux console for which root permissions are required.
A malicious user could overflow a fixed-size buffer and may cause the program to execute arbitrary code with elevated privileges.
For the stable distribution (woody) this problem has been fixed in version 2.08-8woody3.
For the unstable distribution (sid) this problem will be fixed soon.
We recommend that you upgrade your xpcd-svga package immediately.
Severity
Classification
-
CVE CVE-2005-0074 -
CVSS Base Score: 7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities