From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 07A3D15802E for ; Mon, 1 Jul 2024 06:15:02 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 210892BC085; Mon, 1 Jul 2024 06:10:44 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 9197FE2AA4 for ; Mon, 1 Jul 2024 05:56:39 +0000 (UTC) Received: from glsamakerdev.dev.gentoo.org (unknown [140.211.166.165]) by smtp.gentoo.org (Postfix) with ESMTP id 06E9C335CB4 for ; Mon, 1 Jul 2024 05:56:39 +0000 (UTC) Received: from [172.18.0.3] (unknown [172.18.0.3]) by glsamakerdev.dev.gentoo.org (Postfix) with ESMTP id E2099B6E37 for ; Mon, 1 Jul 2024 05:56:38 +0000 (UTC) Subject: [gentoo-announce] [ GLSA 202407-03 ] Liferea: Remote Code Execution Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-announce@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg="pgp-sha512"; boundary="===============6022705922071278079==" From: glsamaker@gentoo.org To: gentoo-announce@lists.gentoo.org Reply-To: security@gentoo.org Date: Mon, 01 Jul 2024 05:56:38 -0000 Message-ID: <171981339892.7.17274765047111739020@3f85d36892cf> X-Archives-Salt: f28ed97f-22f4-491a-8713-53553647f3a2 X-Archives-Hash: 42680b39ee491a395a7fa036aa9c2a12 --===============6022705922071278079== Content-Type: text/plain; charset="utf-8" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202407-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Liferea: Remote Code Execution Date: July 01, 2024 Bugs: #901085 ID: 202407-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A vulnerability has been discovered in Liferea, which can lead to remote code execution. Background ========== Liferea is a feed reader/news aggregator that brings together all of the content from your favorite subscriptions into a simple interface that makes it easy to organize and browse feeds. Its GUI is similar to a desktop mail/news client, with an embedded web browser. Affected packages ================= Package Vulnerable Unaffected ---------------- ------------ ------------ net-news/liferea < 1.12.10 >= 1.12.10 Description =========== A vulnerability has been discovered in Liferea. Please review the CVE identifier referenced below for details. Impact ====== A vulnerability was found in liferea. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source can lead to os command injection. The attack may be launched remotely. Workaround ========== There is no known workaround at this time. Resolution ========== All Liferea users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-news/liferea-1.12.10" References ========== [ 1 ] CVE-2023-1350 https://nvd.nist.gov/vuln/detail/CVE-2023-1350 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202407-03 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 --===============6022705922071278079== Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmaCRRYACgkQFMQkOaVy +9lJvRAAglHf4g2E2EiRXIzK1QOGF3S1ONXZq0AMSFoXN+xYCQ4oiWmitSpGNXvs ggwAFyL/0+wP9yC+iIuglGd5rnIJ3CDAepf+dI7xELZMR1Jl3x1fqhYiIuiMfoM2 JN1K/IKJI9WsJSZSjxanA+MIsHDr8/DyJCpatdE+4jFyGcFH9ZleTNop/cXl2mw7 NeBrcsmOs2DzeymQ8OJG5bHvnwpa6qzCzzwqwk7dYoI4/Cmph92s6fTX8qAuC7Oo GiYb4zyP+nfxHVy1nO9lDIRdP3PEN7XhI6rho8+/gKWnOIxB6DRVE2oFyIfiv2Uu bOr3GUs/3Yopkzcj0cccZ10ohiSFeUz/WwuND3LYIYr15Jr5dWb7ME7BVpeRs8bR yb9dqVy1qnN2cw/4+31p4+r2wVbTs3EPvyhnukuS8DX2fdWnoBMDBQEhjh5MOHZP gLYwkZ9CgEdluK8+3l7z/Bt42pItljfa4S8CqJOm5YPy92g3HGKjnJfSMwsXR1Q9 JQ8kMoD7m0OUxH4CgKz2bw1OzK83do1fnWt8CGBS7HW/qaWAzFfC/AGbSo5xgCjV 5rGlTZTgkzZBj2Oaa0b9m0B1n/jlZ4a78o+pgSzpLCtv5pdcF55tRvZtcIZVMhcl MT+7CFmxEJMJJeyMB8SreZkBrSjXXZSgeEA1FRASg4ijckEGS4E= =YhMT -----END PGP SIGNATURE----- --===============6022705922071278079==--