MDVSA-2010:064
- Package name
- libpng
- Date
- 2010-03-23
- Advisory ID
- MDVSA-2010:064
- Affected versions
- 2009.0 x86_64 , MES5 i586 , 2010.0 x86_64 , 2010.0 i586 , 2009.1 i586 , 2009.0 i586 , 2009.1 x86_64 , MES5 x86_64
Problem description
A vulnerability has been found and corrected in libpng:
The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before
1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly
handle compressed ancillary-chunk data that has a disproportionately
large uncompressed representation, which allows remote attackers to
cause a denial of service (memory and CPU consumption, and application
hang) via a crafted PNG file, as demonstrated by use of the deflate
compression method on data composed of many occurrences of the same
character, related to a decompression bomb attack (CVE-2010-0205).
The updated packages have been patched to correct this issue.
Updated packages
2009.0 x86_64
0a76c1bbd16c3ff1e23027aeba6dbb70 2009.0/x86_64/lib64png3-1.2.31-2.2mdv2009.0.x86_64.rpm 8e01630ee7eb85327dc226632b535ffd 2009.0/x86_64/lib64png-devel-1.2.31-2.2mdv2009.0.x86_64.rpm ed2d30ab62de27e52052fc2bd5958540 2009.0/x86_64/lib64png-static-devel-1.2.31-2.2mdv2009.0.x86_64.rpm 363e0b340727539dab6765b89660fb43 2009.0/x86_64/libpng-source-1.2.31-2.2mdv2009.0.x86_64.rpm 148ad37542ef79c0ed97be519be0478d 2009.0/SRPMS/libpng-1.2.31-2.2mdv2009.0.src.rpm
MES5 i586
cb7196e7825b553e2414b76e236abf36 mes5/i586/libpng3-1.2.31-2.2mdvmes5.i586.rpm 909211c1ac708b89b790e75261ac27b4 mes5/i586/libpng-devel-1.2.31-2.2mdvmes5.i586.rpm 5216e2e783fee0043ccf34c84db096fd mes5/i586/libpng-source-1.2.31-2.2mdvmes5.i586.rpm 321d36768502ddfb1b90086b6204a670 mes5/i586/libpng-static-devel-1.2.31-2.2mdvmes5.i586.rpm b2e5c72d1cc33ec0e53b36a590cafa35 mes5/SRPMS/libpng-1.2.31-2.2mdv2009.0.src.rpm
2010.0 x86_64
08e10e44a82ca8df8c6586bf07d3b6ce 2010.0/x86_64/lib64png3-1.2.40-1.1mdv2010.0.x86_64.rpm 224425aa77a35bd3233c89613562fe7e 2010.0/x86_64/lib64png-devel-1.2.40-1.1mdv2010.0.x86_64.rpm 2682dae8ecdb43af20aadea093d3f03d 2010.0/x86_64/lib64png-static-devel-1.2.40-1.1mdv2010.0.x86_64.rpm be6b483916a098489e41d13bf2f98d63 2010.0/x86_64/libpng-source-1.2.40-1.1mdv2010.0.x86_64.rpm 5911cb03cac15875905c17214463ab65 2010.0/SRPMS/libpng-1.2.40-1.1mdv2010.0.src.rpm
2010.0 i586
50a03f5191cc9383c09ef152fa6ebb8c 2010.0/i586/libpng3-1.2.40-1.1mdv2010.0.i586.rpm 6a528114a5d5cf86c684a179f5ee36b8 2010.0/i586/libpng-devel-1.2.40-1.1mdv2010.0.i586.rpm 9a1154491d80af5ced9a02e37947bf2c 2010.0/i586/libpng-source-1.2.40-1.1mdv2010.0.i586.rpm fb0671ad70f8202f32c7566d08070a8c 2010.0/i586/libpng-static-devel-1.2.40-1.1mdv2010.0.i586.rpm 5911cb03cac15875905c17214463ab65 2010.0/SRPMS/libpng-1.2.40-1.1mdv2010.0.src.rpm
2009.1 i586
eb835d104959137d6ca68071e8f55fc6 2009.1/i586/libpng3-1.2.35-1.1mdv2009.1.i586.rpm c0154024cdcfa2d9fb221e2f4483546c 2009.1/i586/libpng-devel-1.2.35-1.1mdv2009.1.i586.rpm 22ec75a046bd10bfa69afa223e651357 2009.1/i586/libpng-source-1.2.35-1.1mdv2009.1.i586.rpm 2ddcfacf2b6dfa6bf873ffb49bbec43e 2009.1/i586/libpng-static-devel-1.2.35-1.1mdv2009.1.i586.rpm d28bd0a3c425381e441c0c1d4202ee3d 2009.1/SRPMS/libpng-1.2.35-1.1mdv2009.1.src.rpm
2009.0 i586
e0f5c5c179b1224d99f6b16b718069b1 2009.0/i586/libpng3-1.2.31-2.2mdv2009.0.i586.rpm 5e5e6ec06e5d5997d82b1780c6e364e1 2009.0/i586/libpng-devel-1.2.31-2.2mdv2009.0.i586.rpm 48c2108e471923710e8ac01d7984df3a 2009.0/i586/libpng-source-1.2.31-2.2mdv2009.0.i586.rpm 24e60615f07e3310091b96db44821b55 2009.0/i586/libpng-static-devel-1.2.31-2.2mdv2009.0.i586.rpm 148ad37542ef79c0ed97be519be0478d 2009.0/SRPMS/libpng-1.2.31-2.2mdv2009.0.src.rpm
2009.1 x86_64
c9eec8bdd1b1a2aea33a9e5f8dfdc05e 2009.1/x86_64/lib64png3-1.2.35-1.1mdv2009.1.x86_64.rpm 36436b03497287eefe7011cfc4b69ab5 2009.1/x86_64/lib64png-devel-1.2.35-1.1mdv2009.1.x86_64.rpm 810be607e4dcc0c1e6157dd0281b3122 2009.1/x86_64/lib64png-static-devel-1.2.35-1.1mdv2009.1.x86_64.rpm 948e22de64093275c10dbd781cde02ed 2009.1/x86_64/libpng-source-1.2.35-1.1mdv2009.1.x86_64.rpm d28bd0a3c425381e441c0c1d4202ee3d 2009.1/SRPMS/libpng-1.2.35-1.1mdv2009.1.src.rpm
MES5 x86_64
457da1eac0895ee795e2076d46e723d6 mes5/x86_64/lib64png3-1.2.31-2.2mdvmes5.x86_64.rpm 80a132428cc6638972263f7f92fef9da mes5/x86_64/lib64png-devel-1.2.31-2.2mdvmes5.x86_64.rpm 34bea6af1ef00ce04c3f842e6b5fc112 mes5/x86_64/lib64png-static-devel-1.2.31-2.2mdvmes5.x86_64.rpm a89184a0f83c9bc3b295909a174e66d1 mes5/x86_64/libpng-source-1.2.31-2.2mdvmes5.x86_64.rpm b2e5c72d1cc33ec0e53b36a590cafa35 mes5/SRPMS/libpng-1.2.31-2.2mdv2009.0.src.rpm