drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Abstürze und Pufferüberläufe in imlib
Name: |
Abstürze und Pufferüberläufe in imlib
|
|
ID: |
CSSA-2002-019.0 |
|
Distribution: |
Caldera |
|
Plattformen: |
Caldera Server 3.1, Caldera Workstation 3.1, Caldera Server 3.1.1, Caldera Workstation 3.1.1 |
|
Datum: |
Mi, 1. Mai 2002, 13:00 |
|
Referenzen: |
Keine Angabe |
|
Applikationen: |
imlib |
|
Originalnachricht |
--yNb1oOkm5a9FJOVX Content-Disposition: inline
To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com
______________________________________________________________________________
Caldera International, Inc. Security Advisory
Subject: Linux: imlib processes untrusted images Advisory number: CSSA-2002-019.0 Issue date: 2002 April 29 Cross reference: ______________________________________________________________________________
1. Problem Description
Imlib versions prior to 1.9.13 would fall back to loading images via the NetPBM package. NetPBM has various problems itself that make it unsuitable for loading untrusted images. This may allow attackers to construct images that, when loaded by a viewer using Imlib, could cause crashes or potentially, the execution of arbitrary code.
In addition, this version (1.9.14) also includes some further fixes from the imlib team.
2. Vulnerable Supported Versions
System Package ----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to imlib-1.9.14-1.i386.rpm prior to imlib-devel-1.9.14-1.i386.rpm
OpenLinux 3.1.1 Workstation prior to imlib-1.9.14-1.i386.rpm prior to imlib-devel-1.9.14-1.i386.rpm
OpenLinux 3.1 Server prior to imlib-1.9.14-1.i386.rpm prior to imlib-devel-1.9.14-1.i386.rpm
OpenLinux 3.1 Workstation prior to imlib-1.9.14-1.i386.rpm prior to imlib-devel-1.9.14-1.i386.rpm
3. Solution
The proper solution is to install the latest packages.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS
4.2 Packages
56ed4f4cdf53abc39ba462021496314b imlib-1.9.14-1.i386.rpm 743951ea75a12121f6696a57a6a4d091 imlib-devel-1.9.14-1.i386.rpm
4.3 Installation
rpm -Fvh imlib-1.9.14-1.i386.rpm rpm -Fvh imlib-devel-1.9.14-1.i386.rpm
4.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS
4.5 Source Packages
7f31fe77f6e8086aced4bb412b46e55c imlib-1.9.14-1.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS
5.2 Packages
de20299b700ab3918bed0c782abcd6c3 imlib-1.9.14-1.i386.rpm ba96a381bb7c60f20ce74b5645c02fa8 imlib-devel-1.9.14-1.i386.rpm
5.3 Installation
rpm -Fvh imlib-1.9.14-1.i386.rpm rpm -Fvh imlib-devel-1.9.14-1.i386.rpm
5.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS
5.5 Source Packages
060c0a51023524bb1681ac6b68405bd7 imlib-1.9.14-1.src.rpm
6. OpenLinux 3.1 Server
6.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS
6.2 Packages
72ab762b5b78035581fa9200cac775d7 imlib-1.9.14-1.i386.rpm 7e918173391601c5df401be3c7644a78 imlib-devel-1.9.14-1.i386.rpm
6.3 Installation
rpm -Fvh imlib-1.9.14-1.i386.rpm rpm -Fvh imlib-devel-1.9.14-1.i386.rpm
6.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS
6.5 Source Packages
4c864ed09fd05a3740e3a8d6acab2349 imlib-1.9.14-1.src.rpm
7. OpenLinux 3.1 Workstation
7.1 Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS
7.2 Packages
0e03563711a6c9902b6d7d2016a45c84 imlib-1.9.14-1.i386.rpm d0bbec107ff9b58d8851a0cb680bedf3 imlib-devel-1.9.14-1.i386.rpm
7.3 Installation
rpm -Fvh imlib-1.9.14-1.i386.rpm rpm -Fvh imlib-devel-1.9.14-1.i386.rpm
7.4 Source Package Location
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS
7.5 Source Packages
5eed6f4ffeeebf13e266a4078bc45442 imlib-1.9.14-1.src.rpm
8. References
Specific references for this advisory: none
Caldera OpenLinux security resources: http://www.caldera.com/support/security/index.html
Caldera UNIX security resources: http://stage.caldera.com/support/security/
This security fix closes Caldera incidents sr862212, fz520437, erg712001.
9. Disclaimer
Caldera International, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera products.
10. Acknowledgements
Alan Cox and Al Viro discovered and researched the vulnerabilities.
______________________________________________________________________________
--yNb1oOkm5a9FJOVX Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (SCO_SV) Comment: For info see http://www.gnupg.org
iEYEARECAAYFAjzO9koACgkQbluZssSXDTHEewCgvye+V4gPzlJVLW/DvxhhNfVz Ck4An3fP2WiJdG1IokLlkpQK4b5/5IE7 =oBmS -----END PGP SIGNATURE-----
--yNb1oOkm5a9FJOVX--
|
|
|
|