rPath alert rPSA-2006-0219-1 (info)

From:
    	     
 
rPath Update Announcements <announce-noreply@rpath.com>
To:
    	     
 
security-announce@lists.rpath.com, update-announce@lists.rpath.com
Subject:
    	     
 
rPSA-2006-0219-1 info install-info texinfo
Date:
    	     
 
Mon, 27 Nov 2006 10:44:06 -0500
Cc:
    	     
 
full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com, lwn@lwn.net
rPath Security Advisory: 2006-0219-1
Published: 2006-11-27
Products: rPath Linux 1
Rating: Minor
Exposure Level Classification:
    Indirect User Deterministic Unauthorized Access
Updated Versions:
    info=/conary.rpath.com@rpl:devel//1/4.8-6.2-1
    install-info=/conary.rpath.com@rpl:devel//1/4.8-6.2-1
    texinfo=/conary.rpath.com@rpl:devel//1/4.8-6.2-1

References:
    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200...
    https://issues.rpath.com/browse/RPL-810

Description:
    Previous versions of the texinfo package can be caused to execute
    arbitrary code contained in an intentionally malformed texinfo
    file.  These texinfo commands are often run automatically when
    building software packages.