Yellow Dog Linux Security Advisory: YDU-20020522-3

[Dan Burcaw]

Yellow Dog Linux Security Announcement
--------------------------------------

Package:	imlib	
Issue Date: 	May 22, 2002	
Priority:	high		
Advisory ID: 	YDU-20020522-3


1. 	Topic:

	Updated imlib packages are available.


2. 	Problem:

	"Imlib versions prior to 1.9.13 would fall back to
	loading images via the NetPBM package, which has various
	problems making it unsuitable for loading untrusted images.
	Imlib 1.9.13 also fixes various problems in arguments passed
	to malloc().

	These problems may allow attackers to construct images that,
	when loaded by a viewer using Imlib, could cause crashes
	or potentially the execution of arbitrary code.

	Users are advised to upgrade to these errata packages, which
	contain Imlib 1.9.13.

	The Common Vulnerabilities and Exposures project (cve.mitre.org) has
	assigned the names CAN-2002-0167, CAN-2002-0168 to these issues.

	[update May 16 2002]
	The previous release of this errata fixed the aforementioned security
	problems but had a file descriptor leak and a bug which would cause some
	applications (such as the Enlightenment window manager) to hang. These
	updated packages fix these issues."
	(from Red Hat advisory)


3. 	Solution:

   	a) Updating via yup...
   	We suggest that you use the Yellow Dog Update Program (yup)
   	to keep your system up-to-date. The following command(s) will
   	automatically retrieve and install the fixed version of
   	this update onto your system:

		yup update imlib 

   	b) Updating manually...
   	The update can also be retrieved manually from our ftp site
   	below along with the rpm command that should be used to install
   	the update.  (Please use a mirror site)

   		ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.2/ppc/
		rpm -Fvh imlib-*1.9.13-3.7.x.ppc.rpm

4. Verification

MD5 checksum			  Package
--------------------------------  ----------------------------
e9e986d7593a211bec8e76a6457bb2ee  ppc/imlib-1.9.13-3.7.x.ppc.rpm
15fff6e5543179720fea30d57f2b12fe  ppc/imlib-cfgeditor-1.9.13-3.7.x.ppc.rpm
2b5b75fd083ad322a7e30c05a7002c21  ppc/imlib-devel-1.9.13-3.7.x.ppc.rpm
1b2cb79ba963bf758385ca09f23679b5  SRPMS/imlib-1.9.13-3.7.x.src.rpm

If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.

For information regarding the usage of yup, the Yellow Dog Update Program, see 
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml