Arch Linux alert ASA-202101-26 (gobby)
| From: | Morten Linderud via arch-security <arch-security@lists.archlinux.org> | |
| To: | arch-security@archlinux.org | |
| Subject: | [ASA-202101-26] gobby: denial of service | |
| Date: | Thu, 28 Jan 2021 22:59:09 +0100 | |
| Message-ID: | <20210128215909.vx6wvh76skdyj5aa@anathema> | |
| Cc: | Morten Linderud <foxboron@archlinux.org> |
Arch Linux Security Advisory ASA-202101-26 ========================================== Severity: Low Date : 2021-01-20 CVE-ID : CVE-2020-35450 Package : gobby Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1383 Summary ======= The package gobby before version 1:0.5.0+116+g295e697-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1:0.5.0+116+g295e697-1. # pacman -Syu "gobby>=1:0.5.0+116+g295e697-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls. Impact ====== A local attacker can crash the application through a crafted dbus message. References ========== https://bugs.archlinux.org/task/69118 https://github.com/gobby/gobby/issues/183 https://github.com/gobby/gobby/pull/184 https://github.com/gobby/gobby/commit/295e697ac83c6638bc7... https://security.archlinux.org/CVE-2020-35450