Message-ID: <20040629230430.4640.qmail@updates.mandrakesoft.com>
Date: 29 Jun 2004 23:04:30 -0000
From: Mandrake Linux Security Team <security@...ux-mandrake.com>
To: bugtraq@...urityfocus.com
Subject: MDKSA-2004:063 - Updated libpng packages fix potential remote compromise


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           libpng
 Advisory ID:            MDKSA-2004:063
 Date:                   June 29th, 2004

 Affected versions:	 10.0, 9.1, 9.2, Corporate Server 2.1,
			 Multi Network Firewall 8.2
 ______________________________________________________________________

 Problem Description:

 A buffer overflow vulnerability was discovered in libpng due to a wrong
 calculation of some loop offset values. This buffer overflow can lead
 to Denial of Service or even remote compromise.
 
 This vulnerability was initially patched in January of 2003, but it
 has since been noted that fixes were required in two additional places
 that had not been corrected with the earlier patch.  This update uses
 an updated patch to fix all known issues.
 
 After the upgrade, all applications that use libpng should be
 restarted.  Many applications are linked to libpng, so if you are
 unsure of what applications to restart, you may wish to reboot the
 system. Mandrakesoft encourages all users to upgrade immediately.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1363
  http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:008
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 b839285ba258d6e3ccb9d3825b766901  10.0/RPMS/libpng3-1.2.5-10.3.100mdk.i586.rpm
 c014991a9204830f782f68254b622a61  10.0/RPMS/libpng3-devel-1.2.5-10.3.100mdk.i586.rpm
 84a2c6d319d6bbaf9cf304b1e6075fb8  10.0/RPMS/libpng3-static-devel-1.2.5-10.3.100mdk.i586.rpm
 3e33450632704e0c4578b8d37af2113e  10.0/SRPMS/libpng-1.2.5-10.3.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 af1dff46374070937fd9d62475de0254  amd64/10.0/RPMS/lib64png3-1.2.5-10.3.100mdk.amd64.rpm
 e4d7de0a42cc27c9543e94bbb89aed80  amd64/10.0/RPMS/lib64png3-devel-1.2.5-10.3.100mdk.amd64.rpm
 6e0f39bf485aab02b5791272e37a1c8e  amd64/10.0/RPMS/lib64png3-static-devel-1.2.5-10.3.100mdk.amd64.rpm
 3e33450632704e0c4578b8d37af2113e  amd64/10.0/SRPMS/libpng-1.2.5-10.3.100mdk.src.rpm

 Corporate Server 2.1:
 e6056c15e8aee840f23fd724801c68c0  corporate/2.1/RPMS/libpng3-1.2.4-3.5.C21mdk.i586.rpm
 a4800e9eedac026fb7a6a2ef43dcfd35  corporate/2.1/RPMS/libpng3-devel-1.2.4-3.5.C21mdk.i586.rpm
 ca88a0013ce7c6b219b34482f29413f3  corporate/2.1/RPMS/libpng3-static-devel-1.2.4-3.5.C21mdk.i586.rpm
 71fffcd387ae67bbd5b9ed3e3d8e37e3  corporate/2.1/SRPMS/libpng-1.2.4-3.5.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 f01d40d1f4456b99b3e0b45ab9a75ad6  x86_64/corporate/2.1/RPMS/libpng3-1.2.4-3.5.C21mdk.x86_64.rpm
 e0a8f3aebfdebd1f301dd6a609c3fb14  x86_64/corporate/2.1/RPMS/libpng3-devel-1.2.4-3.5.C21mdk.x86_64.rpm
 aa5e793c0fcfde7acb582ca308eafaa6  x86_64/corporate/2.1/RPMS/libpng3-static-devel-1.2.4-3.5.C21mdk.x86_64.rpm
 71fffcd387ae67bbd5b9ed3e3d8e37e3  x86_64/corporate/2.1/SRPMS/libpng-1.2.4-3.5.C21mdk.src.rpm

 Mandrakelinux 9.1:
 47b7136e0ffc87022f0c7b61ba180ede  9.1/RPMS/libpng3-1.2.5-2.3.91mdk.i586.rpm
 8ef669612a5eac43f41cd0b7c9e23c86  9.1/RPMS/libpng3-devel-1.2.5-2.3.91mdk.i586.rpm
 7f9b1b1f639fca07a38abdfa37d79c8b  9.1/RPMS/libpng3-static-devel-1.2.5-2.3.91mdk.i586.rpm
 28d3472cfbd53a9b312281cfdb6351b9  9.1/SRPMS/libpng-1.2.5-2.3.91mdk.src.rpm

 Mandrakelinux 9.1/PPC:
 aa334eb90f70b4053db434b64089d35d  ppc/9.1/RPMS/libpng3-1.2.5-2.3.91mdk.ppc.rpm
 9e2a767d6fe67a949016d971e6c5bc46  ppc/9.1/RPMS/libpng3-devel-1.2.5-2.3.91mdk.ppc.rpm
 7229990aa45e8584c005859db97144b2  ppc/9.1/RPMS/libpng3-static-devel-1.2.5-2.3.91mdk.ppc.rpm
 28d3472cfbd53a9b312281cfdb6351b9  ppc/9.1/SRPMS/libpng-1.2.5-2.3.91mdk.src.rpm

 Mandrakelinux 9.2:
 715a708ef3c4f25ce94908558ca1b0a2  9.2/RPMS/libpng3-1.2.5-7.3.92mdk.i586.rpm
 dbe789399e2034fe5a024ce7b6e9a3ed  9.2/RPMS/libpng3-devel-1.2.5-7.3.92mdk.i586.rpm
 c79e966637991ab3520720f745f0a21e  9.2/RPMS/libpng3-static-devel-1.2.5-7.3.92mdk.i586.rpm
 f4488ff6b1da53cd02a43658f541f6ec  9.2/SRPMS/libpng-1.2.5-7.3.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 222378f78f5047c7941b1d3d0ab82184  amd64/9.2/RPMS/lib64png3-1.2.5-7.3.92mdk.amd64.rpm
 ed110a49ff14580d9e011a19d120c712  amd64/9.2/RPMS/lib64png3-devel-1.2.5-7.3.92mdk.amd64.rpm
 30e005b0d91d77f21dce2833106f69a3  amd64/9.2/RPMS/lib64png3-static-devel-1.2.5-7.3.92mdk.amd64.rpm
 f4488ff6b1da53cd02a43658f541f6ec  amd64/9.2/SRPMS/libpng-1.2.5-7.3.92mdk.src.rpm

 Multi Network Firewall 8.2:
 49f7119cd8a449fb77ab32070b0f5843  mnf8.2/RPMS/libpng3-1.2.4-3.5.M82mdk.i586.rpm
 a4b220d9b228cd6d0bac2854682f1a24  mnf8.2/SRPMS/libpng-1.2.4-3.5.M82mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFA4fV+mqjQ0CJFipgRAhwdAJ90L2Jn81wT4YoHYdtBu5BvlgZCDwCgqnDy
Lvn4WHT3I4jQ+6WeSADyJGo=
=o3tA
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists