Synopsis

gtk2 security update

Type/Severity

Security Advisory: Important

Topic

Updated gtk2 packages that fix a double free vulnerability are now available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The gtk2 package contains the GIMP ToolKit (GTK+), a library for creating
graphical user interfaces for the X Window System.

A bug was found in the way gtk2 processes BMP images. It is possible
that a specially crafted BMP image could cause a denial of service attack
on applications linked against gtk2. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0891 to
this issue.

Users of gtk2 are advised to upgrade to these packages, which contain
a backported patch and is not vulnerable to this issue.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 152317 - CAN-2005-0891 gdk-pixbuf BMP double free DoS

CVEs

• CVE-2005-0891

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
gtk2-2.4.13-14.src.rpm	SHA-256: 636cc78668303e1327f64182ca525f7e78fb95f9b6272c866b928e1c1ac1e26a
x86_64
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-2.4.13-14.x86_64.rpm	SHA-256: 6dc21062f68356f274bacb2ad0bcbc64f5655c0e0e9993dbb0127c7570b08433
gtk2-2.4.13-14.x86_64.rpm	SHA-256: 6dc21062f68356f274bacb2ad0bcbc64f5655c0e0e9993dbb0127c7570b08433
gtk2-devel-2.4.13-14.x86_64.rpm	SHA-256: d49c765ba897b70a3c2afcf59cee978fd3c64e5d33a6f01cd1a3206aa60332d8
gtk2-devel-2.4.13-14.x86_64.rpm	SHA-256: d49c765ba897b70a3c2afcf59cee978fd3c64e5d33a6f01cd1a3206aa60332d8
ia64
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-2.4.13-14.ia64.rpm	SHA-256: 97ec1961f4d68b5d06121fb23961021cb978fcef09f7ae0ab075a7515c70ba50
gtk2-2.4.13-14.ia64.rpm	SHA-256: 97ec1961f4d68b5d06121fb23961021cb978fcef09f7ae0ab075a7515c70ba50
gtk2-devel-2.4.13-14.ia64.rpm	SHA-256: de49b860531c3e887f28931aaca5045968e6aacf3f7aaf1195c7560b4eb01849
gtk2-devel-2.4.13-14.ia64.rpm	SHA-256: de49b860531c3e887f28931aaca5045968e6aacf3f7aaf1195c7560b4eb01849
i386
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-devel-2.4.13-14.i386.rpm	SHA-256: 5a744b19550d43ce56034346fcb7ec95b237e08c4c3ab84e93a6674fad3fe749
gtk2-devel-2.4.13-14.i386.rpm	SHA-256: 5a744b19550d43ce56034346fcb7ec95b237e08c4c3ab84e93a6674fad3fe749

Red Hat Enterprise Linux Workstation 4

SRPM
gtk2-2.4.13-14.src.rpm	SHA-256: 636cc78668303e1327f64182ca525f7e78fb95f9b6272c866b928e1c1ac1e26a
x86_64
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-2.4.13-14.x86_64.rpm	SHA-256: 6dc21062f68356f274bacb2ad0bcbc64f5655c0e0e9993dbb0127c7570b08433
gtk2-devel-2.4.13-14.x86_64.rpm	SHA-256: d49c765ba897b70a3c2afcf59cee978fd3c64e5d33a6f01cd1a3206aa60332d8
ia64
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-2.4.13-14.ia64.rpm	SHA-256: 97ec1961f4d68b5d06121fb23961021cb978fcef09f7ae0ab075a7515c70ba50
gtk2-devel-2.4.13-14.ia64.rpm	SHA-256: de49b860531c3e887f28931aaca5045968e6aacf3f7aaf1195c7560b4eb01849
i386
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-devel-2.4.13-14.i386.rpm	SHA-256: 5a744b19550d43ce56034346fcb7ec95b237e08c4c3ab84e93a6674fad3fe749

Red Hat Enterprise Linux Desktop 4

SRPM
gtk2-2.4.13-14.src.rpm	SHA-256: 636cc78668303e1327f64182ca525f7e78fb95f9b6272c866b928e1c1ac1e26a
x86_64
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-2.4.13-14.x86_64.rpm	SHA-256: 6dc21062f68356f274bacb2ad0bcbc64f5655c0e0e9993dbb0127c7570b08433
gtk2-devel-2.4.13-14.x86_64.rpm	SHA-256: d49c765ba897b70a3c2afcf59cee978fd3c64e5d33a6f01cd1a3206aa60332d8
i386
gtk2-2.4.13-14.i386.rpm	SHA-256: a5ba13f721330905aa1a5aaf1a307f48d76f3c15f34da237ab9973cd3e030c90
gtk2-devel-2.4.13-14.i386.rpm	SHA-256: 5a744b19550d43ce56034346fcb7ec95b237e08c4c3ab84e93a6674fad3fe749

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
gtk2-2.4.13-14.src.rpm	SHA-256: 636cc78668303e1327f64182ca525f7e78fb95f9b6272c866b928e1c1ac1e26a
s390x
gtk2-2.4.13-14.s390.rpm	SHA-256: 681083c092911bf7f8aea94691c1b3cf1ad0f6ca8d37f0f0671f37f368237476
gtk2-2.4.13-14.s390x.rpm	SHA-256: a01fb7baa40911703ea84e9a7ef8dd9c16dea4c8cef5b867f74485bf1f63f8ef
gtk2-devel-2.4.13-14.s390x.rpm	SHA-256: b50cdd06308f0faad08bc0f71ac0fbb5cb82a08681b19377f833bebca0097d99
s390
gtk2-2.4.13-14.s390.rpm	SHA-256: 681083c092911bf7f8aea94691c1b3cf1ad0f6ca8d37f0f0671f37f368237476
gtk2-devel-2.4.13-14.s390.rpm	SHA-256: a472d4d628b9d83f9011ce6f401493bfd04368de2b579f0aa179ed71ca627a4f

Red Hat Enterprise Linux for Power, big endian 4

SRPM
gtk2-2.4.13-14.src.rpm	SHA-256: 636cc78668303e1327f64182ca525f7e78fb95f9b6272c866b928e1c1ac1e26a
ppc
gtk2-2.4.13-14.ppc.rpm	SHA-256: 209e42e1e17ce50a6357ddced32d7fae8c18d0415307df7193cd0a3d30aeb730
gtk2-2.4.13-14.ppc64.rpm	SHA-256: ce2fa2a654f3f6011f96d4990e6b3a12fe8026f094635054c93ba87e27457d15
gtk2-devel-2.4.13-14.ppc.rpm	SHA-256: 99ba6273eab1d438dc18c919706952888fa03208fb115ff76278c353f6965641