[ASA-202101-26] gobby: denial of service

[Morten Linderud]

Arch Linux Security Advisory ASA-202101-26
==========================================

Severity: Low
Date    : 2021-01-20
CVE-ID  : CVE-2020-35450
Package : gobby
Type    : denial of service
Remote  : No
Link    : https://security.archlinux.org/AVG-1383

Summary
=======

The package gobby before version 1:0.5.0+116+g295e697-1 is vulnerable
to denial of service.

Resolution
==========

Upgrade to 1:0.5.0+116+g295e697-1.

# pacman -Syu "gobby>=1:0.5.0+116+g295e697-1"

The problem has been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for
certain set_language calls.

Impact
======

A local attacker can crash the application through a crafted dbus
message.

References
==========

https://bugs.archlinux.org/task/69118
https://github.com/gobby/gobby/issues/183
https://github.com/gobby/gobby/pull/184
https://github.com/gobby/gobby/commit/295e697ac83c6638bc7c6f0498534b12278192c7
https://security.archlinux.org/CVE-2020-35450
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210128/aa7a0ce3/attachment.sig>