- Issued:
- 2005-01-12
- Updated:
- 2005-01-12
RHSA-2005:004 - Security Advisory
Synopsis
lesstif security update
Type/Severity
Security Advisory: Moderate
Topic
An updated lesstif package that fixes flaws in the Xpm library is now
available for Red Hat Enterprise Linux 2.1.
Description
LessTif provides libraries which implement the Motif industry standard
graphical user interface.
During a source code audit, Chris Evans discovered several stack overflow
flaws and an integer overflow flaw in the libXpm library used to decode XPM
(X PixMap) images. A vulnerable version of this library was found within
Lesstif. An attacker could create a carefully crafted XPM file which would
cause an application to crash or potentially execute arbitrary code if
opened by a victim. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the names CAN-2004-0687,CAN-2004-0688, and
CAN-2004-0914 to these issues.
Users of LessTif are advised to upgrade to this erratum package, which
contains backported security patches to the embedded libXpm library.
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
Affected Products
- Red Hat Enterprise Linux Server 2 ia64
- Red Hat Enterprise Linux Server 2 i386
- Red Hat Enterprise Linux Workstation 2 ia64
- Red Hat Enterprise Linux Workstation 2 i386
Fixes
- BZ - 135076 - CAN-2004-0687 buffer overflows in libXpm
- BZ - 135079 - CAN-2004-0688 integer overflows in libXpm (CAN-2004-0914)
CVEs
(none)
References
(none)
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.