Red Hat patches critical hole

Red Hat is warning enterprise Linux users to update their installations of XFree86 to fix a number of serious security bugs, some of which could allow attackers to take over a system. Affected operating systems include Enterprise Linux AS 3, Enterprise Linux ES 3 and Enterprise Linux WS 3, Red Hat said in an advisory.

Separately, vendors have patched critical flaws in ImageMagick, Sylpheed and several components of SGI’s Advanced Linux Environment.

XFree86 is an implementation of the X Window System providing low-level graphics functionality for graphical user interface systems such as KDE and Gnome. The most serious flaw is an integer overflow in the libXpm library, used by some applications in opening XPM images, Red Hat said. An attacker could use a malicious XPM file to execute code on a user’s system.

Red Hat said the bug is only moderately critical, but independent security firm Secunia said in an advisory that the vulnerability is serious because it could allow a remote attacker to gain system access. The latest XFree86 release, issued on 16 March, fixes the libXpm vulnerability and several others.

Red Hat and others are also patching a newly disclosed vulnerability in the Sylpheed email client, which could allow the execution of malicious code when a message is displayed.

Attackers could use a message containing an attachment with a MIME-encoded file name to trigger a boundary error, resulting in a buffer overflow, according to researchers. Versions 0.8.0 to 1.0.3 and development versions 1.9.0 to 1.9.4 are affected, said Secunia, which gave the bug a “highly critical” rating. The fix is available from Sylpheed’s website and from Linux vendors.

MandrakeSoft and Red Hat have patched flaws in ImageMagick, a widely used open-source image editing suite, that could allow the remote execution of malicious code. The bugs include a format string error within the handling of file names and a boundary error in the decoding of PSD images, and could be exploited by specially crafted image files, according to security experts.

SGI issued an update for its Advanced Linux Environment fixing a number of bugs, which could allow remote system takeover or denial of service, or could let malicious local users manipulate the contents of some files. The bugs affect the xpdf, squid and kdenetwork components, SGI said.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now