Gaim is an instant messaging client based on the published TOC
protocol from AOL. The developers of Gaim, an instant messenger client
that combines several different networks, found a vulnerability in the
hyperlink handling code. The 'Manual' browser command passes an
untrusted string to the shell without escaping or reliable quoting,
permitting an attacker to execute arbitrary commands on the users
machine. Unfortunately, Gaim doesn't display the hyperlink before the
user clicks on it. Users who use other inbuilt browser commands aren't
The fixed version of Gaim no longer passes the user's manual browser
command to the shell. Commands which contain the %s in quotes will
need to be amended, so they don't contain any quotes. The 'Manual'
browser command can be edited in the 'General' pane of the
'Preferences' dialog, which can be accessed by clicking 'Options' from
the login window, or 'Tools' and then 'Preferences' from the menu bar
Please download Gaim 0.59.1 or later using Red Carpet. You may also
obtain this update from the Ximian FTP site.
To unsubscribe from this list, or to change your subscription options, follow the link below:

from localhost (localhost [127.0.0.1])
	by phobos.labs.netnoteinc.com (Postfix) with ESMTP id EC69D47C66
	for <zzzz@localhost>; Thu, 22 Aug 2002 09:44:25 -0400 (EDT)
from phobos [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for zzzz@localhost (single-drop); Thu, 22 Aug 2002 14:44:25 +0100 (IST)
from n6.grp.scd.yahoo.com (n6.grp.scd.yahoo.com [66.218.66.90])
    by dogma.slashnull.org (8.11.6/8.11.6) with SMTP id g7MDcOZ08504 for
    <zzzz@example.com>; Thu, 22 Aug 2002 14:38:25 +0100
from unknown (HELO postbox.ee.ed.ac.uk) (129.215.80.253) by
    mta3.grp.scd.yahoo.com with SMTP; 22 Aug 2002 13:38:24 -0000
from ee.ed.ac.uk (sxs@dunblane [129.215.34.86]) by
    postbox.ee.ed.ac.uk (8.11.0/8.11.0) with ESMTP id g7MDcNi28645 for
    <forteana@yahoogroups.com>; Thu, 22 Aug 2002 14:38:23 +0100 (BST)
From Stewart.Smith@ee.ed.ac.uk  Thu Aug 22 14:44:26 2002