A vulnerability has been reported in Dia, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to Dia using the current working directory as part of the module search path. This can be exploited to e.g. execute arbitrary Python code with the privileges of another user by tricking the user into executing Dia in a directory containing a Python file named like one of the modules Dia uses.

Solution
Do not execute Dia in untrusted directories.

Provided and/or discovered by
James Vega

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504251

Deep Links
Links available to Secunia VIM customers