zgv: Multiple buffer overflows — GLSA 200411-12

zgv contains multiple buffer overflows that can potentially lead to the execution of arbitrary code.

Affected packages

Package 	media-gfx/zgv on all architectures
Affected versions 	< 5.8
Unaffected versions 	>= 5.8

Background

zgv is a console image viewer based on svgalib.

Description

Multiple arithmetic overflows have been detected in the image processing code of zgv.

Impact

An attacker could entice a user to open a specially-crafted image file, potentially resulting in execution of arbitrary code with the rights of the user running zgv.

Workaround

There is no known workaround at this time.

Resolution

All zgv users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-gfx/zgv-5.8"

References

    BugTraq Advisory
    CVE-2004-1095