GNU Unrtf Stack-Based Buffer Overflow Vulnerability Allowing Denial-of-Service

A stack-based buffer overflow vulnerability has been identified in GNU Unrtf version 0.21.10. This issue arises in the 'src/main.c' component, where attackers can cause a denial-of-service by injecting crafted input into the filename parameter. The vulnerability can lead to a process crash and, with specially designed payloads, hijacking of the return address.

Impact

Exploitation of this vulnerability causes a process crash, leading to a denial-of-service condition. Additionally, with crafted payloads, it can result in return address hijacking.

Remediation

Users can upgrade to GNU Unrtf version 0.21.11, which addresses this vulnerability. The new version is available on the project's home page.