PT-2007-7512 · Ruby+2 · Libgconf2-Ruby+11

Published 1970-01-01 · Updated 2018-10-15 · CVE-2007-6183

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruby-GNOME 2 versions 0.16.0 and SVN versions before 20071127 libgconf2-ruby (affected versions not specified) libgstreamer0.8-ruby (affected versions not specified) libgnome2-ruby (affected versions not specified) libvte-ruby (affected versions not specified) liblink-grammar4-dev (affected versions not specified) libgnomevfs2-ruby (affected versions not specified) libgnomecanvas2-ruby (affected versions not specified) libgnomeprintui2-ruby (affected versions not specified) libgda2-ruby (affected versions not specified) libgnomeprint2-ruby (affected versions not specified) libpango1-ruby (affected versions not specified)

Description The issue is related to a format string vulnerability in the mdiag initialize function, allowing context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter. Additionally, multiple vulnerabilities have been identified in various Ruby packages for Debian GNU/Linux, which can lead to disruptions in confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For Ruby-GNOME 2 versions 0.16.0 and SVN versions before 20071127: Update to a version after 20071127 to resolve the issue. For libgconf2-ruby, libgstreamer0.8-ruby, libgnome2-ruby, libvte-ruby, liblink-grammar4-dev, libgnomevfs2-ruby, libgnomecanvas2-ruby, libgnomeprintui2-ruby, libgda2-ruby, libgnomeprint2-ruby, and libpango1-ruby: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2015-03669

BDU:2015-03670

BDU:2015-03671

BDU:2015-03672

BDU:2015-03673

BDU:2015-03674

BDU:2015-03675

BDU:2015-03676

BDU:2015-03677

BDU:2015-03678

BDU:2015-03679

CVE-2007-6183

DSA-1431-1

DTSA-102-1

GHSA-XGJ6-PGRM-X4R2

Affected Products

Debian

Ruby-Gnome 2

Libgconf2-Ruby

Libgda2-Ruby

Libgnome2-Ruby

Libgnomecanvas2-Ruby

Libgnomeprint2-Ruby

Libgnomevfs2-Ruby

Libgstreamer0.8-Ruby

Liblink-Grammar4-Dev

Libpango1-Ruby

Libvte-Ruby

References · 39

• 🔥 http://ruby-gnome2.svn.sourceforge.net/viewvc/ruby-gnome2/ruby-gnome2/trunk/gtk/src/rbgtkmessagedialog.c?view=log · Exploit
• https://redhat.com/archives/fedora-package-announce/2007-December/msg00251.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6183 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xgj6-pgrm-x4r2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03679 · Security Note
• http://security.gentoo.org/glsa/glsa-200712-09.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6183 · Security Note
• https://bdu.fstec.ru/vul/2015-03672 · Security Note
• https://bdu.fstec.ru/vul/2015-03673 · Security Note
• http://debian.org/security/2007/dsa-1431 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03670 · Security Note
• https://redhat.com/archives/fedora-package-announce/2007-December/msg00214.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03674 · Security Note
• https://bdu.fstec.ru/vul/2015-03677 · Security Note
• https://bdu.fstec.ru/vul/2015-03676 · Security Note