Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME
    2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to
    execute arbitrary code via format string specifiers in the message parameter. (CVE-2007-6183)

A format string vulnerability in Ruby-GNOME 2 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.

The updated packages have been patched to prevent this issue.

It was discovered that ruby-gnome2, the GNOME-related bindings for the Ruby language, didn't properly sanitize input prior to constructing dialogs. This could allow the execution of arbitrary code if untrusted input is displayed within a dialog.

The remote host is affected by the vulnerability described in GLSA-200712-09 (Ruby-GNOME2: Format string error)

    Chris Rohlf discovered that the 'Gtk::MessageDialog.new()' method in     the file gtk/src/rbgtkmessagedialog.c does not properly sanitize the     'message' parameter before passing it to the gtk_message_dialog_new()     function.
  Impact :

    A remote attacker could send a specially crafted string to an     application using Ruby-GNOME2, possibly leading to the execution of     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

Fix CVE-2007-6183, format string vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2007-6183, format string vulnerability (bugzilla #402871)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422272	SCA: security update for gtk2 (GHSA-xgj6-pgrm-x4r2)	Tenable Cloud Security	SCA Checks	medium
422272	SCA: security update for gtk2 (GHSA-xgj6-pgrm-x4r2)	Tenable Self-Hosted Container Security	SCA Checks	medium
36963	Mandriva Linux Security Advisory : ruby-gnome2 (MDVSA-2008:033)	Nessus	Mandriva Local Security Checks	medium
29339	Debian DSA-1431-1 : ruby-gnome2 - format string	Nessus	Debian Local Security Checks	medium
29296	GLSA-200712-09 : Ruby-GNOME2: Format string error	Nessus	Gentoo Local Security Checks	medium
29277	Fedora 7 : ruby-gnome2-0.16.0-18.fc7 (2007-4229)	Nessus	Fedora Local Security Checks	medium
29276	Fedora 8 : ruby-gnome2-0.16.0-18.fc8 (2007-4216)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2007-6183

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium