News

Developers warn of more security holes in Linux

Open-source developers have warned of serious security holes in two Linux components that could allow attackers to take over a system by tricking a user into viewing a specially-crafted image file or opening an archive.

Imlib, a library for graphics-viewing applications used in the Gnome graphical user environment, contains a bug that could allow the execution of malicious code when a user views a specially crafted bitmap image file, according to Marcus Meissner of Novell 's SuSE Linux.

The vulnerability is due to a boundary error in the decoding of runlength-encoded bitmap images, which can be exploited to cause a buffer overflow, according to an advisory from Danish security firm Secunia, which maintains a vulnerabilities database.

Gentoo, MandrakeSoft and other Linux suppliers have begun distributing fixes for the bug, and a patch is also available from the Gnome project. Imlib 1.x and imlib2 1.x are affected.

The vulnerability is related to last month's BMP-decoding flaw in Qt, a software toolkit used in writing graphical user interface applications using the X Window system in Unix and Linux, Secunia said.

Linux supplier Red Hat warned of three security holes in LHA, an utility for compressing and decompressing LHarc-format archives.

The bugs, affecting all versions up to and including 1.14, could allow the execution of malicious code if a user were tricked into extracting or testing a malicious archive or passing a specially crafted command line to the lha command.

The third bug could allow an attacker to create a directory with shell meta characters in its name which could lead to arbitrary command execution.

Secunia noted that all three of the bugs could be avoided by staying away from untrusted archives. Patches are also available from Red Hat, Gentoo and others.

Matthew Broersma writes for Techworld.com


Email Alerts

Register now to receive ComputerWeekly.com IT-related news, guides and more, delivered to your inbox.
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
 

COMMENTS powered by Disqus  //  Commenting policy