LWN.net Logo

Advertisement

TrustCommerce

E-Commerce & credit card processing - the Open Source way!

Advertise here

Not logged in

Log in now

Create an account

Subscribe to LWN

Recent Features

LWN.net Weekly Edition for December 4, 2008

KSM runs into patent trouble

Tux3: the other next-generation filesystem

LWN.net Weekly Edition for November 27, 2008

LWN.net Weekly Edition for November 20, 2008

Printable page
Weekly edition Kernel Security Distributions Search
Archives Calendar Subscribe Write for LWN LWN.net FAQ

xloadimage: missing input sanitizing, integer overflow

Package(s):xloadimage CVE #(s):CAN-2005-0638 CAN-2005-0639
Created:March 21, 2005 Updated:May 4, 2005
Description: Tavis Ormandy of the Gentoo Linux Security Audit Team has reported a flaw in the handling of compressed images, where shell meta-characters are not adequately escaped. CAN-2005-0638

Insufficient validation of image properties in have been discovered which could potentially result in buffer management errors. CAN-2005-0639

Alerts:
Mandriva MDKSA-2005:076 2005-04-20
Red Hat RHSA-2005:332-01 2005-04-19
Debian DSA-695-1 2005-03-21
Debian DSA-694-1 2005-03-21
Fedora FEDORA-2005-237 2005-03-18
Fedora FEDORA-2005-236 2005-03-18
(Log in to post comments)

Copyright © 2008, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds