Skype for Linux hotfix plugs security hole

Version 2.2.0.99 is the first update to Skype for Linux in nearly a year

Skype has issued a hotfix release for its popular closed source VoIP, video and text chat software for Linux, nearly one year after the last update arrived. The new version of Skype for Linux, labelled 2.2.0.99, is a minor update that includes an upgraded version of the libpng PNG reference library, which closes a security hole.

While specific details are not provided by Skype, this is likely to be the same integer overflow vulnerability that prompted Mozilla to release unscheduled updates for the Firefox web browser and the Thunderbird news and email client earlier this year. According to its developers, the security problem only affects the static package of Skype for Linux downloaded directly from the company; other versions such as those supplied by the Ubuntu Software Centre or packaged for particular Linux distributions by Skype are not affected by the issue. Those unaffected versions remain at version 2.2.0.35 and are not vulnerable as they dynamically link with the host operating system's, hopefully patched long ago, libpng library.

More details about the update can be found in the announcement blog post. The static version of Skype for Linux 2.2.0.99 is available to download and runs on various distributions including Ubuntu, Debian and Fedora. While Skype 2.2 was released more than a year ago and has since been updated, the company still considers it to be "beta" software.

See also:

• Skype 2.2 Beta for Linux released, a report from The H.

(crve)