RHEL 3 / 4 : gedit (RHSA-2005:499)

This script is Copyright (C) 2005-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

An updated gedit package that fixes a file name format string
vulnerability is now available.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team

gEdit is a small text editor designed specifically for the GNOME GUI
desktop.

A file name format string vulnerability has been discovered in gEdit.
It is possible for an attacker to create a file with a carefully
crafted name which, when the file is opened, executes arbitrary
instructions on a victim's machine. Although it is unlikely that a
user would manually open a file with such a carefully crafted file
name, a user could, for example, be tricked into opening such a file
from within an email client. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2005-1686 to this
issue.

Users of gEdit should upgrade to this updated package, which contains
a backported patch to correct this issue.

See also :

https://www.redhat.com/security/data/cve/CVE-2005-1686.html
http://rhn.redhat.com/errata/RHSA-2005-499.html

Solution :

Update the affected gedit and / or gedit-devel packages.

Risk factor :

Low / CVSS Base Score : 2.6
(CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 2.1
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 18473 ()

Bugtraq ID: 13699

CVE ID: CVE-2005-1686