Red Hat Product Errata RHSA-2005:802 - Security Advisory
Issued:
2005-10-18
Updated:
2005-10-18

RHSA-2005:802 - Security Advisory

Synopsis

xloadimage security update

Type/Severity

Security Advisory: Low

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A new xloadimage package that fixes bugs in handling malformed tiff and
pbm/pnm/ppm images, and in handling metacharacters in file names is now
available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

The xloadimage utility displays images in an X Window System window, loads
images into the root window, or writes images into a file. Xloadimage
supports many image types (including GIF, TIFF, JPEG, XPM, and XBM).

A flaw was discovered in xloadimage via which an attacker can construct a
NIFF image with a very long embedded image title. This image can cause a
buffer overflow. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-3178 to this issue.

All users of xloadimage should upgrade to this erratum package, which
contains backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server 2 ia64
  • Red Hat Enterprise Linux Server 2 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Workstation 2 ia64
  • Red Hat Enterprise Linux Workstation 2 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

  • BZ - 170150 - CAN-2005-3178 xloadimage NIFF buffer overflow

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
x86_64
xloadimage-4.1-36.RHEL4.x86_64.rpm SHA-256: 52ab76f427b1ace67d8bac9f7eb2de3d3352ee45ac0404f2576fc4e1ef2e5440
xloadimage-4.1-36.RHEL4.x86_64.rpm SHA-256: 52ab76f427b1ace67d8bac9f7eb2de3d3352ee45ac0404f2576fc4e1ef2e5440
ia64
xloadimage-4.1-36.RHEL4.ia64.rpm SHA-256: 71a8b662a8e2f08bc66b7e8867b5bdc0d3bf9738e2c1c3f5bffaeb084b109c25
xloadimage-4.1-36.RHEL4.ia64.rpm SHA-256: 71a8b662a8e2f08bc66b7e8867b5bdc0d3bf9738e2c1c3f5bffaeb084b109c25
i386
xloadimage-4.1-36.RHEL4.i386.rpm SHA-256: b59e98e29205dd88ffd62b3e79c7b9f41aa75ea255a5df33f47a443774159d9b
xloadimage-4.1-36.RHEL4.i386.rpm SHA-256: b59e98e29205dd88ffd62b3e79c7b9f41aa75ea255a5df33f47a443774159d9b

Red Hat Enterprise Linux Server 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Server 2

SRPM
ia64
i386

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
xloadimage-4.1-36.RHEL4.x86_64.rpm SHA-256: 52ab76f427b1ace67d8bac9f7eb2de3d3352ee45ac0404f2576fc4e1ef2e5440
ia64
xloadimage-4.1-36.RHEL4.ia64.rpm SHA-256: 71a8b662a8e2f08bc66b7e8867b5bdc0d3bf9738e2c1c3f5bffaeb084b109c25
i386
xloadimage-4.1-36.RHEL4.i386.rpm SHA-256: b59e98e29205dd88ffd62b3e79c7b9f41aa75ea255a5df33f47a443774159d9b

Red Hat Enterprise Linux Workstation 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 2

SRPM
ia64
i386

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
xloadimage-4.1-36.RHEL4.x86_64.rpm SHA-256: 52ab76f427b1ace67d8bac9f7eb2de3d3352ee45ac0404f2576fc4e1ef2e5440
i386
xloadimage-4.1-36.RHEL4.i386.rpm SHA-256: b59e98e29205dd88ffd62b3e79c7b9f41aa75ea255a5df33f47a443774159d9b

Red Hat Enterprise Linux Desktop 3

SRPM
x86_64
i386

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
xloadimage-4.1-36.RHEL4.s390x.rpm SHA-256: dc3271601a8918d0f54b4075690e84404353a31c7bb02cf4886bec82bb352629
s390
xloadimage-4.1-36.RHEL4.s390.rpm SHA-256: f253412ef6be736e2544e3211601ad0ae6593d0a22e7cb6900cc2090ecd62dcb

Red Hat Enterprise Linux for IBM z Systems 3

SRPM
s390x
s390

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
xloadimage-4.1-36.RHEL4.ppc.rpm SHA-256: c04b0c8461d4a9ebd95c5a66dbf3369e8c37d83c1c0e643f32f4b0f694de49c0

Red Hat Enterprise Linux for Power, big endian 3

SRPM
ppc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.