RHSA-2008:0136: Moderate: tk security update
Tk is a graphical toolkit for the Tcl scripting language.An input validation flaw was discovered in Tk's GIF image handling. Acode-size value read from a GIF image was not properly validated beforebeing used, leading to a buffer overflow. A specially crafted GIF filecould use this to cause a crash or, potentially, execute code with theprivileges of the application using the Tk graphical toolkit.(CVE-2008-0553)A buffer overflow flaw was discovered in Tk's animated GIF image handling.An animated GIF containing an initial image smaller than subsequent imagescould cause a crash or, potentially, execute code with the privileges ofthe application using the Tk library. (CVE-2007-5137)All users are advised to upgrade to these updated packages which contain abackported patches to resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2008:0136?
The severity of RHSA-2008:0136 is classified as moderate due to an input validation flaw leading to a potential buffer overflow.
How do I fix RHSA-2008:0136?
To fix RHSA-2008:0136, you should upgrade to the latest package versions, specifically tk and tk-devel versions 8.4.13-5.el5_1.1.
What versions of Tk are affected by RHSA-2008:0136?
RHSA-2008:0136 affects Tk versions prior to 8.4.13-5.el5_1.1.
What kind of vulnerability is described in RHSA-2008:0136?
RHSA-2008:0136 describes an input validation flaw in Tk's GIF image handling that leads to a buffer overflow.
Who is the vendor for RHSA-2008:0136?
The vendor for RHSA-2008:0136 is Red Hat.