Skip to navigation

Security Advisory Moderate: tk security update

Advisory: RHSA-2008:0136-1
Type: Security Advisory
Severity: Moderate
Issued on: 2008-02-21
Last updated on: 2008-02-21
Affected Products: RHEL Desktop Workstation (v. 5 client)
Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux EUS (v. 5.1.z server)
CVEs (cve.mitre.org): CVE-2007-5137
CVE-2008-0553

Details

Updated tk packages that fix a security issue are now available for Red Hat
Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Tk is a graphical toolkit for the Tcl scripting language.

An input validation flaw was discovered in Tk's GIF image handling. A
code-size value read from a GIF image was not properly validated before
being used, leading to a buffer overflow. A specially crafted GIF file
could use this to cause a crash or, potentially, execute code with the
privileges of the application using the Tk graphical toolkit.
(CVE-2008-0553)

A buffer overflow flaw was discovered in Tk's animated GIF image handling.
An animated GIF containing an initial image smaller than subsequent images
could cause a crash or, potentially, execute code with the privileges of
the application using the Tk library. (CVE-2007-5137)

All users are advised to upgrade to these updated packages which contain a
backported patches to resolve these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

RHEL Desktop Workstation (v. 5 client)

SRPMS:
tk-8.4.13-5.el5_1.1.src.rpm     MD5: 88f08b8cdf7db2796438f2165fcf729e
 
IA-32:
tk-devel-8.4.13-5.el5_1.1.i386.rpm     MD5: a7b02e4731abafa50dc583fb617882db
 
x86_64:
tk-devel-8.4.13-5.el5_1.1.i386.rpm     MD5: a7b02e4731abafa50dc583fb617882db
tk-devel-8.4.13-5.el5_1.1.x86_64.rpm     MD5: 679a44035eba491102bb4986f595f4bd
 
Red Hat Enterprise Linux (v. 5 server)

SRPMS:
tk-8.4.13-5.el5_1.1.src.rpm     MD5: 88f08b8cdf7db2796438f2165fcf729e
 
IA-32:
tk-8.4.13-5.el5_1.1.i386.rpm     MD5: 51d8b2544dac36ec1602130938be8a66
tk-devel-8.4.13-5.el5_1.1.i386.rpm     MD5: a7b02e4731abafa50dc583fb617882db
 
IA-64:
tk-8.4.13-5.el5_1.1.ia64.rpm     MD5: dbc87041f27ead5cc71692f6b22b988a
tk-devel-8.4.13-5.el5_1.1.ia64.rpm     MD5: 74e5de44f77551a8fcb9fcf0787ab41a
 
PPC:
tk-8.4.13-5.el5_1.1.ppc.rpm     MD5: d544ffde73e0de1726f3adfb9dfea434
tk-8.4.13-5.el5_1.1.ppc64.rpm     MD5: 0cc09ed6f1b94135a66b8a8a33ee3ca5
tk-devel-8.4.13-5.el5_1.1.ppc.rpm     MD5: e538a9e8a906ae638e9466e675ac1cad
tk-devel-8.4.13-5.el5_1.1.ppc64.rpm     MD5: 886b90298a3816fcca260ac2c45ec67d
 
s390x:
tk-8.4.13-5.el5_1.1.s390.rpm     MD5: 19c6ccda42dc74ea93622323c407f20a
tk-8.4.13-5.el5_1.1.s390x.rpm     MD5: 3078a6b6ce10d57d022a86a8c45f604f
tk-devel-8.4.13-5.el5_1.1.s390.rpm     MD5: afb1eea7cf0d8e7b5d845c2c35bd13df
tk-devel-8.4.13-5.el5_1.1.s390x.rpm     MD5: 93b83c8a6b3a638356132e1dbb8db93f
 
x86_64:
tk-8.4.13-5.el5_1.1.i386.rpm     MD5: 51d8b2544dac36ec1602130938be8a66
tk-8.4.13-5.el5_1.1.x86_64.rpm     MD5: dd703677cc63b7abdf276da89edbfb04
tk-devel-8.4.13-5.el5_1.1.i386.rpm     MD5: a7b02e4731abafa50dc583fb617882db
tk-devel-8.4.13-5.el5_1.1.x86_64.rpm     MD5: 679a44035eba491102bb4986f595f4bd
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
tk-8.4.13-5.el5_1.1.src.rpm     MD5: 88f08b8cdf7db2796438f2165fcf729e
 
IA-32:
tk-8.4.13-5.el5_1.1.i386.rpm     MD5: 51d8b2544dac36ec1602130938be8a66
 
x86_64:
tk-8.4.13-5.el5_1.1.i386.rpm     MD5: 51d8b2544dac36ec1602130938be8a66
tk-8.4.13-5.el5_1.1.x86_64.rpm     MD5: dd703677cc63b7abdf276da89edbfb04
 
Red Hat Enterprise Linux EUS (v. 5.1.z server)

SRPMS:
tk-8.4.13-5.el5_1.1.src.rpm     MD5: 88f08b8cdf7db2796438f2165fcf729e
 
IA-32:
tk-8.4.13-5.el5_1.1.i386.rpm     MD5: 51d8b2544dac36ec1602130938be8a66
tk-devel-8.4.13-5.el5_1.1.i386.rpm     MD5: a7b02e4731abafa50dc583fb617882db
 
IA-64:
tk-8.4.13-5.el5_1.1.ia64.rpm     MD5: dbc87041f27ead5cc71692f6b22b988a
tk-devel-8.4.13-5.el5_1.1.ia64.rpm     MD5: 74e5de44f77551a8fcb9fcf0787ab41a
 
PPC:
tk-8.4.13-5.el5_1.1.ppc.rpm     MD5: d544ffde73e0de1726f3adfb9dfea434
tk-8.4.13-5.el5_1.1.ppc64.rpm     MD5: 0cc09ed6f1b94135a66b8a8a33ee3ca5
tk-devel-8.4.13-5.el5_1.1.ppc.rpm     MD5: e538a9e8a906ae638e9466e675ac1cad
tk-devel-8.4.13-5.el5_1.1.ppc64.rpm     MD5: 886b90298a3816fcca260ac2c45ec67d
 
s390x:
tk-8.4.13-5.el5_1.1.s390.rpm     MD5: 19c6ccda42dc74ea93622323c407f20a
tk-8.4.13-5.el5_1.1.s390x.rpm     MD5: 3078a6b6ce10d57d022a86a8c45f604f
tk-devel-8.4.13-5.el5_1.1.s390.rpm     MD5: afb1eea7cf0d8e7b5d845c2c35bd13df
tk-devel-8.4.13-5.el5_1.1.s390x.rpm     MD5: 93b83c8a6b3a638356132e1dbb8db93f
 
x86_64:
tk-8.4.13-5.el5_1.1.i386.rpm     MD5: 51d8b2544dac36ec1602130938be8a66
tk-8.4.13-5.el5_1.1.x86_64.rpm     MD5: dd703677cc63b7abdf276da89edbfb04
tk-devel-8.4.13-5.el5_1.1.i386.rpm     MD5: a7b02e4731abafa50dc583fb617882db
tk-devel-8.4.13-5.el5_1.1.x86_64.rpm     MD5: 679a44035eba491102bb4986f595f4bd
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

290991 - CVE-2007-5137 Tk GIF processing buffer overflow
431518 - CVE-2008-0553 tk: GIF handling buffer overflow


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/