I'm linux user and I'm thinking about it's vulnerabilities to malware.
Can I get any malware if I run only trusted applications from distro's repository?
This is a question likely to generate better feedback at Security SE.
Packages are generally signed; if the signing key has been compromised (by breaking in into the computer where private key is stored), all bets are off. Then an attacker may craft a package with malware inside, sign it with the key, hack one or several mirrors, replace the packages and wait for infection to spread before it is found out.
A threat may come as a source-code patch that is committed without due review process and introduces a vulnerability into a piece of software, and then this attack vector is exploited in the wild.
Existing applications may have a score of vulnerabilities that allow malware to install itself on a given computer.
As a bottom line, there is no such thing as a "trusted application" anywhere, anytime. You as computer owner and maintainer bear the ultimate responsibility for the overall safety and security of your system, especially if you keep it connected to the 'Net where there be dragons. Would suggest starting reading on computer security, and again, a nice starting point is the Security StackExchange site.
The other side of what @Deer Hunter has said, and what I think you are getting at, is "can malware install itself and get executed like so many similar malware programs Windows gets?". The answer to that is no. Without direct user involvement giving permissions for installation and, then, execution, this cannot happen.
Yes, you can get malware.
Imagine combining a PNG-library-flaw like CVE-2007-5259 with a glibc-problem like CVE-2011-1089. Into an execution under your normal user account with a priviledge escalation triggerd by - lets say viewing a PNG-picture in the
There might even be a backdoor programmed into your OS by a regular programmer.