Updates close holes in GNU gv

A vulnerability in the GNU tool gv, used for displaying PostScript and PDF documents, threatens system security. The opening of a document with overlong comments creates a buffer overflow in the ps_gettext() function, the bug advisory reports. That in turn could be exploited to plant malicious code and execute it with the user's rights. Files prepared in this way can make their way onto computers as mail attachments or as downloads from a website. Version 3.6.2 and earlier are affected. No official update has been released. Several Linux distributors like Debian and Mandriva have already released packages without the bug.

See also:

• GNU GV Stack Buffer Overflow Vulnerability, bug advisory on Bugtraq
• Updated gv packages fix buffer overflow vulnerability, bug advisory from Mandriva

(ehe)