<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> <glsa id="202105-13"> <title>Mumble: User-assisted execution of arbitrary code</title> <synopsis>A vulnerability has been found in Mumble that could allow a remote attacker to execute arbitrary code. </synopsis> <product type="ebuild">mumble</product> <announced>2021-05-26</announced> <revised count="1">2021-05-26</revised> <bug>770973</bug> <access>remote</access> <affected> <package name="media-sound/mumble" auto="yes" arch="*"> <unaffected range="ge">1.3.4</unaffected> <vulnerable range="lt">1.3.4</vulnerable> </package> </affected> <background> <p>Mumble is low-latency voice chat software intended for use with gaming.</p> </background> <description> <p>Please review the CVE identifiers referenced below for details.</p> </description> <impact type="normal"> <p>A remote attacker could entice a user to open a specially crafted server list (web page) using Mumble, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. </p> </impact> <workaround> <p>There is no known workaround at this time.</p> </workaround> <resolution> <p>All Mumble users should upgrade to the latest version:</p> <code> # emerge --sync # emerge --ask --oneshot --verbose ">=media-sound/mumble-1.3.4" </code> </resolution> <references> <uri link="https://nvd.nist.gov/vuln/detail/CVE-2021-27229">CVE-2021-27229</uri> </references> <metadata tag="requester" timestamp="2021-05-25T20:52:52Z">whissi</metadata> <metadata tag="submitter" timestamp="2021-05-26T08:36:32Z">whissi</metadata> </glsa>