Erik Sjölund has reported a vulnerability in XView, which potentially can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to some boundary errors in the function "xv_parse_one()" in "xv_parse.c". This may be exploited to cause a buffer overflow and execute arbitrary code with escalated privileges via a setuid application linked against the vulnerable library.

Solution
Grant only trusted users access to affected systems.

Provided and/or discovered by
Erik Sjölund

Original Advisory
http://www.debian.org/security/2005/dsa-672

Deep Links
Links available to Secunia VIM customers