GLSA 201708-07: evilvte: User-assisted execution of arbitrary code

http://security.gentoo.org/

Severity:	normal
Title:	evilvte: User-assisted execution of arbitrary code
Date:	08/21/2017
Bugs:	#611290
ID:	201708-07

Synopsis

Improper hypertext validation might allow remote attackers to execute arbitrary code.

Background

VTE based, highly customizable terminal emulator

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
x11-terms/evilvte	< 0.5.1		All supported architectures

Description

Steve Kemp of Debian identified a flaw in evilvte which does not properly validate hypertext links. Please review the Debian bug report referenced below.

Impact

Remote attackers could execute arbitrary code by enticing a user to click a hyperlink in their terminal.

Workaround

There is no known workaround at this time.

Resolution

Gentoo Security recommends that users unmerge evilvte:

      # emerge --unmerge "x11-terms/evilvte"

References

Debian Bug #854585

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201708-07.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.