Banshee: Arbitrary code execution An environment variable processing error has been reported in Banshee, possibly allowing local attacker to load a specially crafted shared library. banshee 2014-02-05 2014-02-05 345567 local 1.8.0-r1 1.8.0-r1

Banshee is a multimedia management and playback application for GNOME.

Banshee places a zero-length directory name in PATH, which allows libraries to be loaded from the working directory.

A local attacker could put specially crafted library into working directory of Banshee, possibly resulting in execution of arbitrary code with the privileges of the process, or a Denial of Service condition.

There is no known workaround at this time.

All Banshee users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=media-sound/banshee-1.8.0-r1"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since November 17, 2010. It is likely that your system is already no longer affected by this issue.

CVE-2010-3998 craig pinkbyte