Image problem: another Linux patch

[Tami]

Image problem: another Linux patch
Highly critical issue with graphics viewing library.


By Matthew Broersma, Techworld


All major Linux vendors have released fixes for several serious bugs in an image-processing library, some of which could allow an attacker to take control of a system.


The bugs were [url=\"http://www.libpng.org/pub/png/libpng.html\"]discovered[/url] by researcher Chris Evans in libpng, a library that supports the viewing of PNG graphics files. PNG is a format developed as an alternative to GIF images, and is usually supported by Linux systems.


While the library has been in use and tested for seven years, Evans said he found multiple errors that could allow an attacker to execute arbitrary code on a system by tricking a user into viewing a specially crafted PNG image. The bugs include buffer overflows, NULL pointer dereferences and integer overflows, Evans said. Some bugs allow code execution while others only allow an attacker to crash an application.


Security experts said the most likely exploit was via graphics files. \"The vulnerabilities can for example be exploited by tricking a user into visiting a malicious website or viewing a malicious email with an affected application linked to libpng,\" said security firm Secunia in an [url=\"http://secunia.com/advisories/12219/\"]advisory[/url].


Red Hat has issued patches for its [url=\"http://secunia.com/advisories/12225/\"]Enterprise[/url] and [url=\"http://secunia.com/advisories/12223/\"]Developer[/url] operating systems. Other vendors, including [url=\"http://secunia.com/advisories/12221/\"]Debian[/url], [url=\"http://secunia.com/advisories/12220/\"]MandrakeSoft[/url]and [url=\"http://secunia.com/advisories/12222/\"]Suse[/url], have also released patches.

[url=\"http://www.techworld.com/security/news/index.cfm?NewsID=2044\"]Source[/url]

[ner0]

[font=\"Courier\"][color=\"purple\"]uh oh <img src=\'http://www.killanet.net/forum3/public/s ... unsure.gif\' class=\'bbc_emoticon\' alt=\':unsure:\' /> [/color][/font]