[FLSA-2005:2005] Updated gdk-pixbuf packages fix security flaws

From: Marc Deslauriers (marcdeslauriers_at_videotron.ca)
Date: 02/24/05

  • Next message: Rodrigo Barbosa: "Re: [Full-Disclosure] Xfree86 video buffering?" 
    Date: Wed, 23 Feb 2005 22:54:27 -0500
To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com

    ---------------------------------------------------------------------
                    Fedora Legacy Update Advisory

    Synopsis: Updated gdk-pixbuf packages fix security flaws
    Advisory ID: FLSA:2005
    Issue date: 2005-02-23
    Product: Red Hat Linux
    Keywords: Bugfix
    Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2005
    CVE Names: CAN-2004-0111 CAN-2004-0753 CAN-2004-0782
                        CAN-2004-0783 CAN-2004-0788
    ---------------------------------------------------------------------

    ---------------------------------------------------------------------
    1. Topic:

    Updated gdk-pixbuf packages that fix several security flaws are now
    available.

    The gdk-pixbuf package contains an image loading library used with the
    GNOME GUI desktop environment.

    2. Relevant releases/architectures:

    Red Hat Linux 7.3 - i386
    Red Hat Linux 9 - i386

    3. Problem description:

    Thomas Kristensen discovered a bitmap file that would cause the
    Evolution mail reader to crash. This issue was caused by a flaw that
    affects versions of the gdk-pixbuf package prior to 0.20. To exploit
    this flaw, a remote attacker could send (via email) a carefully-crafted
    BMP file, which would cause Evolution to crash. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CAN-2004-0111 to this issue.

    During testing of a previously fixed flaw in Qt (CAN-2004-0691), a flaw
    was discovered in the BMP image processor of gdk-pixbuf. An attacker
    could create a carefully crafted BMP file which would cause an
    application to enter an infinite loop and not respond to user input when
    the file was opened by a victim. The Common Vulnerabilities and
    Exposures project (cve.mitre.org) has assigned the name CAN-2004-0753 to
    this issue.

    During a security audit, Chris Evans discovered a stack and a heap
    overflow in the XPM image decoder. An attacker could create a carefully
    crafted XPM file which could cause an application linked with gtk2 to
    crash or possibly execute arbitrary code when the file was opened by a
    victim. (CAN-2004-0782, CAN-2004-0783)

    Chris Evans also discovered an integer overflow in the ICO image
    decoder. An attacker could create a carefully crafted ICO file which
    could cause an application linked with gtk2 to crash when the file is
    opened by a victim. (CAN-2004-0788)

    Users of gdk-pixbuf are advised to upgrade to these packages, which
    contain backported patches and are not vulnerable to these issues.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which
    are not installed but included in the list will not be updated. Note
    that you can also use wildcards (*.rpm) if your current directory *only*
    contains the desired RPMs.

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the
    appropriate RPMs being upgraded on your system. This assumes that you
    have yum or apt-get configured for obtaining Fedora Legacy content.
    Please visit http://www fedoralegacy.org/docs for directions on how to
    configure yum and apt-get.

    5. Bug IDs fixed:

    http://bugzilla.fedora.us - bug #2005 - gdk-pixbuf bmp image loader DOS

    6. RPMs required:

    Red Hat Linux 7.3:

    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gdk-pixbuf-0.22.0-7.73.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/gdk-pixbuf-0.22.0-7.73.2.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/gdk-pixbuf-devel-0.22.0-7.73.2.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/gdk-pixbuf-gnome-0.22.0-7.73.2.legacy.i386.rpm

    Red Hat Linux 9:

    SRPM:
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gdk-pixbuf-0.22.0-7.90.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/9/updates/i386/gdk-pixbuf-0.22.0-7.90.2.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/gdk-pixbuf-devel-0.22.0-7.90.2.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/gdk-pixbuf-gnome-0.22.0-7.90.2.legacy.i386.rpm

    7. Verification:

    SHA1 sum Package Name
    ---------------------------------------------------------------------

    a29384912cdf63b635694050c1ecf2f8f56f2e3c
    redhat/7.3/updates/i386/gdk-pixbuf-0.22.0-7.73.2.legacy.i386.rpm
    2e9223509766118f53b1934f77ed9d625558772c
    redhat/7.3/updates/i386/gdk-pixbuf-devel-0.22.0-7.73.2.legacy.i386.rpm
    550e131ff9707a021c1949472ed94c23aec2391c
    redhat/7.3/updates/i386/gdk-pixbuf-gnome-0.22.0-7.73.2.legacy.i386.rpm
    ed74d85b0419e4b3eba53a2a65cd87be1b460572
    redhat/7.3/updates/SRPMS/gdk-pixbuf-0.22.0-7.73.2.legacy.src.rpm
    1783c789f1eca62ee264eb7dd5aaef93084a154a
    redhat/9/updates/i386/gdk-pixbuf-0.22.0-7.90.2.legacy.i386.rpm
    a7c5d85e2d367b81425ddd0eab32fb18b1b316b2
    redhat/9/updates/i386/gdk-pixbuf-devel-0.22.0-7.90.2.legacy.i386.rpm
    50eea5f1886468a5ec6c9d0d10765afcae9791a1
    redhat/9/updates/i386/gdk-pixbuf-gnome-0.22.0-7.90.2.legacy.i386.rpm
    ccc7442f3dd7dd696a5000cbd5cc1d9624f89673
    redhat/9/updates/SRPMS/gdk-pixbuf-0.22.0-7.90.2.legacy.src.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy org/about/security.php

    You can verify each package with the following command:

         rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

         sha1sum <filename>

    8. References:

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0111
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0753
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0788
    http://bugzilla.gnome.org/show_bug.cgi?id=150601

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    ---------------------------------------------------------------------

  • Next message: Rodrigo Barbosa: "Re: [Full-Disclosure] Xfree86 video buffering?"

    Relevant Pages