advisories/10351.adv

ID: MGASA-2013-0164
pubtime: 1370521473
type: security
src:
  2:
   core:
     - flightgear-2.6.0-2.3.mga2
  3:
   core:
     - flightgear-2.10.0-1.3.mga3
subject: Updated flightgear package fixes security vulnerability
description: |
  It was reported that FlightGear suffers from improper handling of format
  strings when FlightGear is started with allowances for remote access (via
  the --props or --telnet commandline arguments).  If a remote attacker were
  able to connect to FlightGear and set special parameters related with clouds,
  it could cause FlightGear to crash.
references:
 - http://kuronosec.blogspot.ca/2013/04/flightgear-remote-format-string.html
 - http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106922.html
 - https://bugs.mageia.org/show_bug.cgi?id=10351
1	ID: MGASA-2013-0164
2	pubtime: 1370521473
3	type: security
4	src:
5	2:
6	core:
7	- flightgear-2.6.0-2.3.mga2
8	3:
9	core:
10	- flightgear-2.10.0-1.3.mga3
11	subject: Updated flightgear package fixes security vulnerability
12	description: \|
13	It was reported that FlightGear suffers from improper handling of format
14	strings when FlightGear is started with allowances for remote access (via
15	the --props or --telnet commandline arguments). If a remote attacker were
16	able to connect to FlightGear and set special parameters related with clouds,
17	it could cause FlightGear to crash.
18	references:
19	- http://kuronosec.blogspot.ca/2013/04/flightgear-remote-format-string.html
20	- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106922.html
21	- https://bugs.mageia.org/show_bug.cgi?id=10351