Debian 3.0: DSA 294-1 Critical: gkrellm-newsticker Remote Exploits

Brian Campbell discovered two security-related problems in
gkrellm-newsticker, a plugin for the gkrellm system monitor program,
which provides a news ticker from RDF feeds. The Common
Vulnerabilities and Exposures project identifies the following
problems:

CAN-2003-0205

It can launch a web browser of the user's choice when the ticker
title is clicked by using the URI given by the feed. However,
special shell characters are not properly escaped enabling a
malicious feed to execute arbitrary shell commands on the clients
machine.

CAN-2003-0206

It crashes the entire gkrellm system on feeds where link or title
elements are not entirely on a single line. A malicious server
could therefore craft a denial of service.

For the stable distribution (woody) these problems have been fixed in
version 0.3-3.1

The old stable distribution (potato) is not affected since it doesn't
contain gkrellm-newsticker packages.

For the unstable distribution (sid) these problems is not yet fixed.

We recommend tha...