Tk: Buffer overflow — GLSA 200710-07

A buffer overflow vulnerability has been discovered in Tk.

Affected packages

Background

Tk is a toolkit for creating graphical user interfaces.

Description

Reinhard Max discovered a boundary error in Tk when processing an interlaced GIF with two frames where the second is smaller than the first one.

Impact

A remote attacker could entice a user to open a specially crafted GIF image with a Tk-based software, possibly resulting in the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-lang/tk-8.4.15-r1"

References

• CVE-2007-4851

Release date
October 07, 2007

Latest revision
October 07, 2007: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 192539