Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » CSSA-2002-019.0-Linux: imlib processes untrusted images

CSSA-2002-019.0-Linux: imlib processes untrusted images

by Nikola Strahija on May 1st, 2002 Imlib versions prior to 1.9.13 would fall back to loading images via the NetPBM package. NetPBM has various problems itself that make it unsuitable for loading untrusted images. This may allow attackers to construct images that, when loaded by a viewer using Imlib, could cause crashes or potentially, the execution of arbitrary code. In addition, this version (1.9.14) also includes some further fixes from the imlib team.


2. Vulnerable Supported Versions

System Package
----------------------------------------------------------------------

OpenLinux 3.1.1 Server prior to imlib-1.9.14-1.i386.rpm
prior to imlib-devel-1.9.14-1.i386.rpm

OpenLinux 3.1.1 Workstation prior to imlib-1.9.14-1.i386.rpm
prior to imlib-devel-1.9.14-1.i386.rpm

OpenLinux 3.1 Server prior to imlib-1.9.14-1.i386.rpm
prior to imlib-devel-1.9.14-1.i386.rpm

OpenLinux 3.1 Workstation prior to imlib-1.9.14-1.i386.rpm
prior to imlib-devel-1.9.14-1.i386.rpm


3. Solution

The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

4.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

4.2 Packages

56ed4f4cdf53abc39ba462021496314b imlib-1.9.14-1.i386.rpm
743951ea75a12121f6696a57a6a4d091 imlib-devel-1.9.14-1.i386.rpm

4.3 Installation

rpm -Fvh imlib-1.9.14-1.i386.rpm
rpm -Fvh imlib-devel-1.9.14-1.i386.rpm

4.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

4.5 Source Packages

7f31fe77f6e8086aced4bb412b46e55c imlib-1.9.14-1.src.rpm


5. OpenLinux 3.1.1 Workstation

5.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

5.2 Packages

de20299b700ab3918bed0c782abcd6c3 imlib-1.9.14-1.i386.rpm
ba96a381bb7c60f20ce74b5645c02fa8 imlib-devel-1.9.14-1.i386.rpm

5.3 Installation

rpm -Fvh imlib-1.9.14-1.i386.rpm
rpm -Fvh imlib-devel-1.9.14-1.i386.rpm

5.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

5.5 Source Packages

060c0a51023524bb1681ac6b68405bd7 imlib-1.9.14-1.src.rpm


6. OpenLinux 3.1 Server

6.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

6.2 Packages

72ab762b5b78035581fa9200cac775d7 imlib-1.9.14-1.i386.rpm
7e918173391601c5df401be3c7644a78 imlib-devel-1.9.14-1.i386.rpm

6.3 Installation

rpm -Fvh imlib-1.9.14-1.i386.rpm
rpm -Fvh imlib-devel-1.9.14-1.i386.rpm

6.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

6.5 Source Packages

4c864ed09fd05a3740e3a8d6acab2349 imlib-1.9.14-1.src.rpm


7. OpenLinux 3.1 Workstation

7.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

7.2 Packages

0e03563711a6c9902b6d7d2016a45c84 imlib-1.9.14-1.i386.rpm
d0bbec107ff9b58d8851a0cb680bedf3 imlib-devel-1.9.14-1.i386.rpm

7.3 Installation

rpm -Fvh imlib-1.9.14-1.i386.rpm
rpm -Fvh imlib-devel-1.9.14-1.i386.rpm

7.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

7.5 Source Packages

5eed6f4ffeeebf13e266a4078bc45442 imlib-1.9.14-1.src.rpm


8. References

Specific references for this advisory:
none


Caldera OpenLinux security resources:
http://www.caldera.com/support/security/index.html

Caldera UNIX security resources:
http://stage.caldera.com/support/security/

This security fix closes Caldera incidents sr862212, fz520437,
erg712001.


9. Disclaimer

Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.


10. Acknowledgements

Alan Cox and Al Viro discovered and researched the
vulnerabilities.

______________________________________________________________________________


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »