Open-source developers have warned of serious security holes in two Linux components that could allow attackers to take over a system by tricking a user into viewing a specially crafted image file or opening an archive. Patches exist for the bugs, which affect LHA and imlib.
Imlib, a library for graphics-viewing applications used in the Gnome graphical user environment, contains a bug that could allow the execution of malicious code when a user views a specially crafted bit-map image file, according to Marcus Meissner of Novell Inc.'s Suse Linux. The vulnerability is due to a boundary error in the decoding of runlength-encoded bitmap images, which can be exploited to cause a buffer overflow, according to an advisory from Danish security firm Secunia, which maintains a vulnerabilities database.
Gentoo, MandrakeSoft SA and other Linux vendors have begun distributing fixes for the bug, and a patch is also available from the Gnome project. Imlib 1.x and imlib2 1.x are affected.
The vulnerability is related to last month's BMP-decoding flaw in Qt, a software toolkit used in writing graphical user interface applications using the X Window system in Unix and Linux, Secunia said.
Linux vendor Red Hat Inc. warned of three security holes in LHA, an utility for compressing and decompressing LHarc-format archives. The bugs, affecting all versions up to and including 1.14, could allow the execution of malicious code if a user were tricked into extracting or testing a malicious archive or passing a specially crafted command line to the lha command. The third bug could allow an attacker to create a directory with shell meta characters in its name which could lead to arbitrary command execution.
Secunia noted that all three of the bugs could be avoided by staying away from untrusted archives. Patches are also available from Red Hat, Gentoo and others.
Sign up to receive Security Resource Alerts
A comprehensive security management solution can help you streamline, as well as grow, your current or evolving business. In this way, a strategic security approach can help you increase your competitiveness in these challenging market conditions.
Download now! »
Find out how you can effectively collect, normalize and archive enterprise-wide, security-related data that is invaluable for security investigation and compliance reporting.
Download now! »
This session focuses on the intersection of role management and identity compliance, and addresses the importance of identity compliance in enterprise governance and the challenges that organizations may face in achieving it.
View now! »
Recommend This
