Elm and Mplayer Exploits: Critical Security Flaws Affecting Linux Systems

Two serious security flaws have turned up in software widely distributed with Linux and Unix. The bugs affect Elm (Electronic Mail for Unix), a venerable e-mail client still used by many Linux and Unix sysadmins, and Mplayer, a cross-platform movie player that is one of the most popular of its kind on Linux. The Elm flaw involves a boundary error when the client reads an e-mail's "Expires" header. A specially crafted e-mail could exploit the bug to cause a buffer overflow and execute malicious code on a system, according to security researchers.

Adding to the flaw's potential impact, exploit code has begun circulating on the Internet, according to FrSIRT, the French Security Incident Response Team, which published sample code on its site.

The flaw affects Elm version 2.5 PL7 and earlier, and has been fixed in a new update, version 2.5 PL8. A patched version is available via Elm-related websites, or from operating system vendors such as Red Hat.