Paketname
libpng
Datum
2010-03-23
Advisory ID
MDVSA-2010:064
Betroffene Versionen
2009.0 x86_64 , MES5 i586 , 2010.0 x86_64 , 2010.0 i586 , 2009.1 i586 , 2009.0 i586 , 2009.1 x86_64 , MES5 x86_64

Problembeschreibung

A vulnerability has been found and corrected in libpng:

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before
1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly
handle compressed ancillary-chunk data that has a disproportionately
large uncompressed representation, which allows remote attackers to
cause a denial of service (memory and CPU consumption, and application
hang) via a crafted PNG file, as demonstrated by use of the deflate
compression method on data composed of many occurrences of the same
character, related to a decompression bomb attack (CVE-2010-0205).

The updated packages have been patched to correct this issue.

Aktualisierte Pakete

2009.0 x86_64

 0a76c1bbd16c3ff1e23027aeba6dbb70  2009.0/x86_64/lib64png3-1.2.31-2.2mdv2009.0.x86_64.rpm
 8e01630ee7eb85327dc226632b535ffd  2009.0/x86_64/lib64png-devel-1.2.31-2.2mdv2009.0.x86_64.rpm
 ed2d30ab62de27e52052fc2bd5958540  2009.0/x86_64/lib64png-static-devel-1.2.31-2.2mdv2009.0.x86_64.rpm
 363e0b340727539dab6765b89660fb43  2009.0/x86_64/libpng-source-1.2.31-2.2mdv2009.0.x86_64.rpm 
 148ad37542ef79c0ed97be519be0478d  2009.0/SRPMS/libpng-1.2.31-2.2mdv2009.0.src.rpm

MES5 i586

 cb7196e7825b553e2414b76e236abf36  mes5/i586/libpng3-1.2.31-2.2mdvmes5.i586.rpm
 909211c1ac708b89b790e75261ac27b4  mes5/i586/libpng-devel-1.2.31-2.2mdvmes5.i586.rpm
 5216e2e783fee0043ccf34c84db096fd  mes5/i586/libpng-source-1.2.31-2.2mdvmes5.i586.rpm
 321d36768502ddfb1b90086b6204a670  mes5/i586/libpng-static-devel-1.2.31-2.2mdvmes5.i586.rpm 
 b2e5c72d1cc33ec0e53b36a590cafa35  mes5/SRPMS/libpng-1.2.31-2.2mdv2009.0.src.rpm

2010.0 x86_64

 08e10e44a82ca8df8c6586bf07d3b6ce  2010.0/x86_64/lib64png3-1.2.40-1.1mdv2010.0.x86_64.rpm
 224425aa77a35bd3233c89613562fe7e  2010.0/x86_64/lib64png-devel-1.2.40-1.1mdv2010.0.x86_64.rpm
 2682dae8ecdb43af20aadea093d3f03d  2010.0/x86_64/lib64png-static-devel-1.2.40-1.1mdv2010.0.x86_64.rpm
 be6b483916a098489e41d13bf2f98d63  2010.0/x86_64/libpng-source-1.2.40-1.1mdv2010.0.x86_64.rpm 
 5911cb03cac15875905c17214463ab65  2010.0/SRPMS/libpng-1.2.40-1.1mdv2010.0.src.rpm

2010.0 i586

 50a03f5191cc9383c09ef152fa6ebb8c  2010.0/i586/libpng3-1.2.40-1.1mdv2010.0.i586.rpm
 6a528114a5d5cf86c684a179f5ee36b8  2010.0/i586/libpng-devel-1.2.40-1.1mdv2010.0.i586.rpm
 9a1154491d80af5ced9a02e37947bf2c  2010.0/i586/libpng-source-1.2.40-1.1mdv2010.0.i586.rpm
 fb0671ad70f8202f32c7566d08070a8c  2010.0/i586/libpng-static-devel-1.2.40-1.1mdv2010.0.i586.rpm 
 5911cb03cac15875905c17214463ab65  2010.0/SRPMS/libpng-1.2.40-1.1mdv2010.0.src.rpm

2009.1 i586

 eb835d104959137d6ca68071e8f55fc6  2009.1/i586/libpng3-1.2.35-1.1mdv2009.1.i586.rpm
 c0154024cdcfa2d9fb221e2f4483546c  2009.1/i586/libpng-devel-1.2.35-1.1mdv2009.1.i586.rpm
 22ec75a046bd10bfa69afa223e651357  2009.1/i586/libpng-source-1.2.35-1.1mdv2009.1.i586.rpm
 2ddcfacf2b6dfa6bf873ffb49bbec43e  2009.1/i586/libpng-static-devel-1.2.35-1.1mdv2009.1.i586.rpm 
 d28bd0a3c425381e441c0c1d4202ee3d  2009.1/SRPMS/libpng-1.2.35-1.1mdv2009.1.src.rpm

2009.0 i586

 e0f5c5c179b1224d99f6b16b718069b1  2009.0/i586/libpng3-1.2.31-2.2mdv2009.0.i586.rpm
 5e5e6ec06e5d5997d82b1780c6e364e1  2009.0/i586/libpng-devel-1.2.31-2.2mdv2009.0.i586.rpm
 48c2108e471923710e8ac01d7984df3a  2009.0/i586/libpng-source-1.2.31-2.2mdv2009.0.i586.rpm
 24e60615f07e3310091b96db44821b55  2009.0/i586/libpng-static-devel-1.2.31-2.2mdv2009.0.i586.rpm 
 148ad37542ef79c0ed97be519be0478d  2009.0/SRPMS/libpng-1.2.31-2.2mdv2009.0.src.rpm

2009.1 x86_64

 c9eec8bdd1b1a2aea33a9e5f8dfdc05e  2009.1/x86_64/lib64png3-1.2.35-1.1mdv2009.1.x86_64.rpm
 36436b03497287eefe7011cfc4b69ab5  2009.1/x86_64/lib64png-devel-1.2.35-1.1mdv2009.1.x86_64.rpm
 810be607e4dcc0c1e6157dd0281b3122  2009.1/x86_64/lib64png-static-devel-1.2.35-1.1mdv2009.1.x86_64.rpm
 948e22de64093275c10dbd781cde02ed  2009.1/x86_64/libpng-source-1.2.35-1.1mdv2009.1.x86_64.rpm 
 d28bd0a3c425381e441c0c1d4202ee3d  2009.1/SRPMS/libpng-1.2.35-1.1mdv2009.1.src.rpm

MES5 x86_64

 457da1eac0895ee795e2076d46e723d6  mes5/x86_64/lib64png3-1.2.31-2.2mdvmes5.x86_64.rpm
 80a132428cc6638972263f7f92fef9da  mes5/x86_64/lib64png-devel-1.2.31-2.2mdvmes5.x86_64.rpm
 34bea6af1ef00ce04c3f842e6b5fc112  mes5/x86_64/lib64png-static-devel-1.2.31-2.2mdvmes5.x86_64.rpm
 a89184a0f83c9bc3b295909a174e66d1  mes5/x86_64/libpng-source-1.2.31-2.2mdvmes5.x86_64.rpm 
 b2e5c72d1cc33ec0e53b36a590cafa35  mes5/SRPMS/libpng-1.2.31-2.2mdv2009.0.src.rpm

Referenzen