Bug 4589

Summary:	libpng new security issue CVE-2011-3026
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	Normal	CC:	davidwhodgins, fundawang, sysadmin-bugs, tmb
Version:	1	Keywords:	validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	http://www.libpng.org/pub/png/libpng.html
Whiteboard:
Source RPM:	libpng-1.2.46-1.mga1.src.rpm	CVE:
Status comment:

Description David Walser 2012-02-19 15:24:37 CET

I saw this announced early this morning on freecode.com, it is a buffer overflow vulnerability according to upstream.  A fix has been issued and Funda has already built it for Mageia 1.

Advisory:
========================

Updated libpng packages fix security vulnerabilities:

All branches of libpng prior to versions 1.5.9, 1.4.9, 1.2.47,
and 1.0.57, respectively, fail to correctly validate a heap
allocation in png_decompress_chunk(), which can lead to a
buffer-overrun and the possibility of execution of hostile
code on 32-bit systems (CVE-2011-3026).

References:
http://www.libpng.org/pub/png/libpng.html
http://www.libpng.org/pub/png/src/libpng-1.2.47-README.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3026
========================

Updated packages in core/updates_testing:
========================
libpng-devel-1.2.47-1.mga1
libpng-source-1.2.47-1.mga1
libpng-static-devel-1.2.47-1.mga1
libpng3-1.2.47-1.mga1

from libpng-1.2.47-1.mga1.src.rpm

David Walser 2012-02-19 15:24:50 CET

CC: (none) => fundawang

Comment 1 David Walser 2012-02-19 15:25:19 CET

Funda, please assign to QA if this is ready to go.  Thanks.

Funda Wang 2012-02-20 11:22:29 CET

Assignee: bugsquad => qa-bugs

Comment 2 Dave Hodgins 2012-02-20 17:48:22 CET

Testing complete on i586 for the srpm
libpng-1.2.47-1.mga1.src.rpm

As usual for libpng, just testing that xv somefile.png works.

CC: (none) => davidwhodgins

Comment 3 claire robinson 2012-02-23 13:03:45 CET

Tested ok x86_64

Update validated.

Could sysadmin please push from core/updates_testing to core/updates

Advisory etc on comment 0

Thankyou!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs
Hardware: i586 => All

Comment 4 Thomas Backlund 2012-02-24 21:34:17 CET

update pushed

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED