| Summary: | Updated libpng package to fix several CVE issues | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | Funda Wang <fundawang> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, sysadmin-bugs, tmb |
| Version: | 1 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Source RPM: | libpng-1.2.46-1.mga1 | CVE: | |
| Status comment: | |||
@distrib-admins, the reason I updated the version rather using CVE patches, is that most other distros are upgrading rather patches for these issues. *** Bug 3263 has been marked as a duplicate of this bug. *** Testing complete on i586 for the srpm libpng-1.2.46-1.mga1.src.rpm No POC, so just confirming xv *.png works. CC:
(none) =>
davidwhodgins Tested OK x86_64
Advisory
-----------------
Some vulnerabilities were discovered and corrected in libpng:
* All released versions of libpng (from 1.0 onward) have a buffer overrun in
the code that promotes palette images with transparency (1 channel) to
grayscale+alpha images (2 channels), but only for applications that call
png_rgb_to_gray() and not png_set_expand(). (None are known.) An arbitrary
amount of memory may be overwritten in this case, with arbitrary
(attacker-controlled) data. This vulnerability has been assigned ID
CVE-2011-2690.
* libpng 1.2.20 and later crashes in png_default_error() due to internal use of
a NULL pointer instead of the empty string (""). This vulnerability has been
assigned ID CVE-2011-2691.
* Many (most?) versions of libpng read uninitialized memory when handling empty
sCAL chunks, and they handle malformed sCAL chunks (those lacking a delimiting
NULL between the internal strings) incorrectly. This vulnerability has been
assigned ID CVE-2011-2692.
The updated packages have been updated to latest stable version to correct
these issues, plus other bug fixes.
-------------------
SRPM: libpng-1.2.46-1.mga1.src.rpm
Could sysadmin please push from core/updates_testing to core/updates
Thankyou!Keywords:
(none) =>
validated_update Update pushed. Status:
NEW =>
RESOLVED |
Some vulnerabilities were discovered and corrected in libpng: * All released versions of libpng (from 1.0 onward) have a buffer overrun in the code that promotes palette images with transparency (1 channel) to grayscale+alpha images (2 channels), but only for applications that call png_rgb_to_gray() and not png_set_expand(). (None are known.) An arbitrary amount of memory may be overwritten in this case, with arbitrary (attacker-controlled) data. This vulnerability has been assigned ID CVE-2011-2690. * libpng 1.2.20 and later crashes in png_default_error() due to internal use of a NULL pointer instead of the empty string (""). This vulnerability has been assigned ID CVE-2011-2691. * Many (most?) versions of libpng read uninitialized memory when handling empty sCAL chunks, and they handle malformed sCAL chunks (those lacking a delimiting NULL between the internal strings) incorrectly. This vulnerability has been assigned ID CVE-2011-2692. The updated packages have been updated to latest stable version to correct these issues, plus other bug fixes.