severity security product gaim keywords gaim hyperlink manual references can NUMBER NUMBER URL gaim changelog URL gaim is an instant messaging client based on the published toc protocol from aol the developers of gaim an instant messenger client that combines several different networks found a vulnerability in the hyperlink handling code the manual browser command passes an untrusted string to the shell without escaping or reliable quoting permitting an attacker to execute arbitrary commands on the users machine unfortunately gaim doesn t display the hyperlink before the user clicks on it users who use other inbuilt browser commands aren t vulnerable the fixed version of gaim no longer passes the user s manual browser command to the shell commands which contain the s in quotes will need to be amended so they don t contain any quotes the manual browser command can be edited in the general pane of the preferences dialog which can be accessed by clicking options from the login window or tools and then preferences from the menu bar in the buddy list window please download gaim NUMBER NUMBER NUMBER or later using red carpet you may also obtain this update from the ximian ftp site debian potato URL URL URL mandrake NUMBER NUMBER URL mandrake NUMBER NUMBER URL mandrake NUMBER NUMBER URL redhat NUMBER NUMBER URL URL redhat NUMBER NUMBER URL URL redhat NUMBER NUMBER URL URL redhat NUMBER NUMBER URL URL redhat NUMBER NUMBER URL URL solaris NUMBER NUMBER URL suse NUMBER NUMBER URL URL suse NUMBER NUMBER URL URL suse NUMBER NUMBER URL URL suse NUMBER NUMBER URL URL yellowdog NUMBER NUMBER URL URL yellowdog NUMBER NUMBER URL URL yellowdog NUMBER NUMBER URL URL _______________________________________________ updates maillist updates URL to unsubscribe from this list or to change your subscription options follow the link below URL 