GNU GLOBAL: Arbitrary code execution A vulnerability in GNU GLOBAL was discovered, possibly allowing remote attackers to execute arbitrary code. global 2020-08-08 2020-08-08 646348 remote 6.6.4 6.6.4

GNU GLOBAL is a source code tagging system that works the same way across diverse environments, such as Emacs editor, Vi editor, Less viewer, Bash shell, various web browsers, etc.

A vulnerability was found in an undocumented function of gozilla.

A remote attacker could entice a user to open a specially crafted URL using GNU GLOBAL, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.

There is no known workaround at this time.

All GNU GLOBAL users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=dev-util/global-6.6.4"
CVE-2017-17531 sam_c sam_c