CVE-2007-6183 gtk2 vulnerable to Use of Externally-Controlled Format String
MediumCVSS 6.8
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems gtk2(RubyGems) | < 0.17.0 | 0.17.0 |
| ruby gnome2 | = 0.16.0 | No fix listed |
| debian/ruby-gnome2(Debian:10) | < 0.16.0-10 | 0.16.0-10 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- rubygnome2-mdiaginitialize-format-string(38757) vdb-entry
- FEDORA-2007-4216 vendor-advisory
- FEDORA-2007-4229 vendor-advisory
- bugs.debian.org
- bugs.gentoo.org
- em386.blogspot.com technical-description
- GLSA-200712-09 vendor-advisory
- 3407 third-party-advisory
- DSA-1431 vendor-advisory
- web.archive.org
- web.archive.org
- www.mandriva.com
- github.com
- 40774 vdb-entry
- ruby-gnome2.svn.sourceforge.net exploit
- 27825 third-party-advisory vendor-advisory
- 27975 third-party-advisory vendor-advisory
- 28022 third-party-advisory vendor-advisory
- 28060 third-party-advisory vendor-advisory
- MDVSA-2008:033 vendor-advisory
- 20071127 Ruby/Gnome2 0.16.0 Format String Vulnerability mailing-list
- 26616 vdb-entry
- ADV-2007-4022 vdb-entry vendor-advisory