RHSA-2008:0135: Moderate: tk security update
Tk is a graphical toolkit for the Tcl scripting language.An input validation flaw was discovered in Tk's GIF image handling. Acode-size value read from a GIF image was not properly validated beforebeing used, leading to a buffer overflow. A specially crafted GIF filecould use this to cause a crash or, potentially, execute code with theprivileges of the application using the Tk graphical toolkit.(CVE-2008-0553)A buffer overflow flaw was discovered in Tk's animated GIF image handling.An animated GIF containing an initial image smaller than subsequent imagescould cause a crash or, potentially, execute code with the privileges ofthe application using the Tk library. (CVE-2007-5378)All users are advised to upgrade to these updated packages which contain abackported patches to resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2008:0135?
The severity of RHSA-2008:0135 is classified as moderate due to the potential for a buffer overflow vulnerability in Tk's GIF image handling.
How do I fix RHSA-2008:0135?
To fix RHSA-2008:0135, upgrade the tk and tk-devel packages to version 8.4.7-3.el4_6.1 or later.
What causes the vulnerability in RHSA-2008:0135?
The vulnerability in RHSA-2008:0135 is caused by an input validation flaw in the handling of code-size values from GIF images, leading to possible buffer overflow.
Which software is affected by RHSA-2008:0135?
The affected software for RHSA-2008:0135 includes the tk and tk-devel packages in versions prior to 8.4.7-3.el4_6.1.
Is there a workaround for RHSA-2008:0135?
There are no specific workarounds for RHSA-2008:0135; the best solution is to apply the recommended updates.