Paketname
libpng
Datum
2007-11-13
Advisory ID
MDKSA-2007:217
Betroffene Versionen
CS4.0 i586 , CS4.0 x86_64 , MNF2.0 i586 , 2007.0 x86_64 , 2007.1 i586 , 2007.0 i586 , CS3.0 x86_64 , 2008.0 x86_64 , CS3.0 i586 , 2008.0 i586 , 2007.1 x86_64

Problembeschreibung

Multiple vulnerabilities were discovered in libpng:

An off-by-one error when handling ICC profile chunks in the
png_set_iCCP() function (CVE-2007-5266; only affects Mandriva Linux
2008.0).

George Cook and Jeff Phillips reported several errors in pngrtran.c,
such as the use of logical instead of bitwise functions and incorrect
comparisons (CVE-2007-5268; only affects Mandriva Linux 2008.0).

Tavis Ormandy reported out-of-bounds read errors in several PNG chunk
handling functions (CVE-2007-5269).

Updated packages have been patched to correct these issues.
For Mandriva Linux 2008.0, libpng 1.2.22 is being provided which
corrects all three issues.

Aktualisierte Pakete

CS4.0 i586

 c57f8cee626aec43891cd5040f1eb5bf  corporate/4.0/i586/libpng3-1.2.8-1.4.20060mlcs4.i586.rpm
 bfa61e1aee1360dc57518d0bd8c6a12a  corporate/4.0/i586/libpng3-devel-1.2.8-1.4.20060mlcs4.i586.rpm
 597398c4eae476728ba746432c4edb61  corporate/4.0/i586/libpng3-static-devel-1.2.8-1.4.20060mlcs4.i586.rpm 
 5163d8dec7610e578e043c6b429cceff  corporate/4.0/SRPMS/libpng-1.2.8-1.4.20060mlcs4.src.rpm

CS4.0 x86_64

 ae34926bcf70c445c63845b985cbbb2a  corporate/4.0/x86_64/lib64png3-1.2.8-1.4.20060mlcs4.x86_64.rpm
 9c3e1e0c7e38036e8068ac36d02bd83d  corporate/4.0/x86_64/lib64png3-devel-1.2.8-1.4.20060mlcs4.x86_64.rpm
 36058d8c1363e7d6b4887adefbe153a0  corporate/4.0/x86_64/lib64png3-static-devel-1.2.8-1.4.20060mlcs4.x86_64.rpm
 c57f8cee626aec43891cd5040f1eb5bf  corporate/4.0/x86_64/libpng3-1.2.8-1.4.20060mlcs4.i586.rpm
 bfa61e1aee1360dc57518d0bd8c6a12a  corporate/4.0/x86_64/libpng3-devel-1.2.8-1.4.20060mlcs4.i586.rpm 
 5163d8dec7610e578e043c6b429cceff  corporate/4.0/SRPMS/libpng-1.2.8-1.4.20060mlcs4.src.rpm

MNF2.0 i586

 2764fc9a199ef409305d093911908f6c  mnf/2.0/i586/libpng3-1.2.5-10.9.M20mdk.i586.rpm
 6f3d649546be0b347432bdeef1f6557f  mnf/2.0/i586/libpng3-devel-1.2.5-10.9.M20mdk.i586.rpm
 6d016e9b217a4de53fc86cb4f898aed1  mnf/2.0/i586/libpng3-static-devel-1.2.5-10.9.M20mdk.i586.rpm 
 1048fae70e7fecfceef6bbb9b9abbc2e  mnf/2.0/SRPMS/libpng-1.2.5-10.9.M20mdk.src.rpm

2007.0 x86_64

 d367cc02889fa90498a8d0daa03cb89b  2007.0/x86_64/lib64png3-1.2.12-2.4mdv2007.0.x86_64.rpm
 17216e150ba6841c0f1101f2f254a26b  2007.0/x86_64/lib64png3-devel-1.2.12-2.4mdv2007.0.x86_64.rpm
 890f7e25640ed0d140304bd84e05a8f4  2007.0/x86_64/lib64png3-static-devel-1.2.12-2.4mdv2007.0.x86_64.rpm 
 4a1f620d405d0bc92c24912f5d109726  2007.0/SRPMS/libpng-1.2.12-2.4mdv2007.0.src.rpm

2007.1 i586

 6a9c7d8f81e83eb36247ff0490a6e282  2007.1/i586/libpng3-1.2.13-2.2mdv2007.1.i586.rpm
 1f78dea1216514f421f406672ddbc27e  2007.1/i586/libpng3-devel-1.2.13-2.2mdv2007.1.i586.rpm
 49d4946c5b4555a757472dc2267ab7ca  2007.1/i586/libpng3-static-devel-1.2.13-2.2mdv2007.1.i586.rpm 
 bd23b5b93b5f4e196c098d451ba61740  2007.1/SRPMS/libpng-1.2.13-2.2mdv2007.1.src.rpm

2007.0 i586

 6e6a1a752c3323210b7873d9050cc2d1  2007.0/i586/libpng3-1.2.12-2.4mdv2007.0.i586.rpm
 44c4d399df519a3774a470cf819fb396  2007.0/i586/libpng3-devel-1.2.12-2.4mdv2007.0.i586.rpm
 a1933a55e7ee2fc3a250c6c429dfce93  2007.0/i586/libpng3-static-devel-1.2.12-2.4mdv2007.0.i586.rpm 
 4a1f620d405d0bc92c24912f5d109726  2007.0/SRPMS/libpng-1.2.12-2.4mdv2007.0.src.rpm

CS3.0 x86_64

 825654d8659640d47bd35f31ece3d34c  corporate/3.0/x86_64/lib64png3-1.2.5-10.9.C30mdk.x86_64.rpm
 e016ff95747174902fc7008ea87daa6e  corporate/3.0/x86_64/lib64png3-devel-1.2.5-10.9.C30mdk.x86_64.rpm
 eb52ed562b56248b3fc1c1b52f333d30  corporate/3.0/x86_64/lib64png3-static-devel-1.2.5-10.9.C30mdk.x86_64.rpm
 0e5f7e4d91eb46712cdfaff8abf8bd9f  corporate/3.0/x86_64/libpng3-1.2.5-10.9.C30mdk.i586.rpm 
 3c2af2ec7c62f0cab6175036b96645de  corporate/3.0/SRPMS/libpng-1.2.5-10.9.C30mdk.src.rpm

2008.0 x86_64

 9ec7f1e81514c27a0c3e818157cb9ac9  2008.0/x86_64/lib64png-devel-1.2.22-0.1mdv2008.0.x86_64.rpm
 f5db16ab9f528476d1ce5835a5686af1  2008.0/x86_64/lib64png-static-devel-1.2.22-0.1mdv2008.0.x86_64.rpm
 989081716cb746497bcde8b846c7cae7  2008.0/x86_64/lib64png3-1.2.22-0.1mdv2008.0.x86_64.rpm
 31a6c01ff31fec291b6906852d0e8b29  2008.0/x86_64/libpng-source-1.2.22-0.1mdv2008.0.x86_64.rpm 
 57077fbd7202ada302d435df35eb0b3f  2008.0/SRPMS/libpng-1.2.22-0.1mdv2008.0.src.rpm

CS3.0 i586

 0e5f7e4d91eb46712cdfaff8abf8bd9f  corporate/3.0/i586/libpng3-1.2.5-10.9.C30mdk.i586.rpm
 3a90decd4088b6a49691c147d65bb7b0  corporate/3.0/i586/libpng3-devel-1.2.5-10.9.C30mdk.i586.rpm
 bba0383eecdebceffbfbba57db77af78  corporate/3.0/i586/libpng3-static-devel-1.2.5-10.9.C30mdk.i586.rpm 
 3c2af2ec7c62f0cab6175036b96645de  corporate/3.0/SRPMS/libpng-1.2.5-10.9.C30mdk.src.rpm

2008.0 i586

 60aeee7c6232797cbb019b847354a1ee  2008.0/i586/libpng-devel-1.2.22-0.1mdv2008.0.i586.rpm
 945c51dca471b3e85417fd98ee75d6a5  2008.0/i586/libpng-source-1.2.22-0.1mdv2008.0.i586.rpm
 d4a9f587e93f29844db3ffbb8e2ad5c8  2008.0/i586/libpng-static-devel-1.2.22-0.1mdv2008.0.i586.rpm
 5971dd0615c2c41e1e8501e24b80fc35  2008.0/i586/libpng3-1.2.22-0.1mdv2008.0.i586.rpm 
 57077fbd7202ada302d435df35eb0b3f  2008.0/SRPMS/libpng-1.2.22-0.1mdv2008.0.src.rpm

2007.1 x86_64

 eaa4631b4186ecfa64f7d5e5618e8ed6  2007.1/x86_64/lib64png3-1.2.13-2.2mdv2007.1.x86_64.rpm
 a7ea7e725848d8f9b2064b5c8f6af2a4  2007.1/x86_64/lib64png3-devel-1.2.13-2.2mdv2007.1.x86_64.rpm
 0886fd8b11d64a9104b145bd6a80dabd  2007.1/x86_64/lib64png3-static-devel-1.2.13-2.2mdv2007.1.x86_64.rpm 
 bd23b5b93b5f4e196c098d451ba61740  2007.1/SRPMS/libpng-1.2.13-2.2mdv2007.1.src.rpm

Referenzen