Description
Buffer overflow in Library of Assorted Spiffy Things (LibAST) 0.6.1 and earlier, as used in Eterm and possibly other software, allows local users to execute arbitrary code as the utmp user via a long -X command line argument (alternative configuration file name).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-976-1 libast - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- 22735 vdb-entry
- MDKSA-2006:029 vendor-advisory
- http://freshmeat.net/projects/libast/?branch_id=17907&release_id=217840
- http://www.rosiello.org/en/read_bugs.php?id=25
- ADV-2006-0314 vdb-entry
- 18632 third-party-advisory
- 16350 vdb-entry
- DSA-976 vendor-advisory
- eterm-libast-filename-bo(24303) vdb-entry
- 18916 third-party-advisory
- 18586 third-party-advisory
- 373 third-party-advisory
- GLSA-200601-14 vendor-advisory
- 20060123 [ Rosiello Security ] Eterm-LibAST Advisory mailing-list
- 20060125 Rosiello Security - Eterm-LibAST Advisory mailing-list
- 20060123 LibAST 0.7 Release Fixes Security Vulnerability mailing-list