Bug 3892 - libglpng1 is older than version in MDV 2010.2
Summary: libglpng1 is older than version in MDV 2010.2
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 1
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard:
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2011-12-27 02:24 CET by David Walser
Modified: 2011-12-31 23:10 CET (History)
5 users (show)

See Also:
Source RPM: libglpng-1.45-4.mga1.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2011-12-27 02:24:52 CET
The newest version available in 2010.2/main/updates is libglpng1-1.45-4.1mdv2010.1 so this package doesn't get upgraded when upgrading to Mageia 1.
Comment 1 David Walser 2011-12-27 02:32:26 CET
This is due to a security patch that was added in the MDV package that was missed by Mageia.  It is also missing in the Cauldron version of this package.  The patch is available in Mandriva's SVN:

http://svn.mandriva.com/svn/packages/cooker/libglpng/current/SOURCES/libglpng-1.45-CVE-2010-1519.diff
David Walser 2011-12-27 02:43:26 CET

Component: RPM Packages => Security

Comment 2 Manuel Hiebel 2011-12-27 02:44:39 CET
Hi, thanks for reporting this bug.
As there is no maintainer for this package I added the committers in CC.

(Please set the status to 'assigned' if you are working on it)

CC: (none) => dmorganec, fundawang

Comment 3 David Walser 2011-12-27 02:57:21 CET
The security advisory is here:

http://lists.mandriva.com/security-announce/2010-09/msg00013.php
D Morgan 2011-12-28 03:35:13 CET

Assignee: bugsquad => dmorganec

D Morgan 2011-12-28 03:44:45 CET

Status: NEW => ASSIGNED

Comment 4 D Morgan 2011-12-28 03:51:34 CET
done and pushed in the BS

Assignee: dmorganec => qa-bugs

Comment 5 Dave Hodgins 2011-12-29 01:24:01 CET
Testing complete on i586 for the srpm
libglpng-1.45-5.2.mga1.src.rpm

No poc for the cve, so just testing that it works.
According to urpmq --whatrequires libglpng1
the only package using this library is chromium.
The game chromium-bsu works, so testing complete.

CC: (none) => davidwhodgins

Comment 6 David Walser 2011-12-29 01:29:13 CET
I can second Dave Hodgins' report that it works on i586 by playing chromium-bsu.
Comment 7 Manuel Hiebel 2011-12-31 18:26:07 CET
Testing complete on x86_64

Advisory
-------------
This update addresses the folloving CVE:

- CVE-2010-1519 
Multiple integer overflows in glpng.c in glpng 1.45 allow context-dependent attackers to execute arbitrary code via a crafted PNG image, related to (1) the pngLoadRawF function and (2) the pngLoadF function, leading to heap-based buffer overflows. 
-------------


SRPM: 	libglpng-1.45-5.2.mga1.src.rpm

Could sysadmin please push from core/updates_testing to core/updates

Thankyou!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 8 Thomas Backlund 2011-12-31 23:10:34 CET
Update pushed.

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.