Date: Tue, 4 Feb 2003 16:03:48 +0100
From: Daniel Ahlberg <aliz@gentoo.org>
To: bugtraq@securityfocus.com
Subject: GLSA: qt-dcgui
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200302-03
- - --------------------------------------------------------------------
PACKAGE : qt-dcgui
SUMMARY : file leaking
DATE : 2003-02-04 15:03 UTC
EXPLOIT : remote
- - --------------------------------------------------------------------
- From announcment:
"All versions < 0.2.2 have a major security vulnerability in the
directory parser. This bug allow a remote attacker to download files
outside the sharelist. It's recommend that you upgrade the packages
immediatly."
Read the full announcment at:
http://dc.ketelhot.de/pipermail/dc/2003-January/000094.html
SOLUTION
It is recommended that all Gentoo Linux users who are running
net-p2p/qt-dcgui upgrade to qt-dcgui-0.2.4 as follows:
emerge sync
emerge -u qt-dcgui
emerge clean
- - --------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
styx@gentoo.org
- - --------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+P9ZJfT7nyhUpoZMRAtoYAJ45ZBiV/8y3CFmv+/UiHTHfN+q1rACfd7bf
GxwCDv8PO1m17sJJMp33KfA=
=2ZdT
-----END PGP SIGNATURE-----
