| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <200408061254.JAA10754@frajuto.distro.conectiva> Date: Fri, 6 Aug 2004 09:54:05 -0300 From: Conectiva Updates <secure@...ectiva.com.br> To: conectiva-updates@...aleguas.conectiva.com.br, lwn@....net, bugtraq@...urityfocus.com, security-alerts@...uxsecurity.com, linsec@...ts.seifried.org Subject: [CLA-2004:856] Conectiva Security Announcement - libpng -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : libpng SUMMARY : Several vulnerabilities in libpng DATE : 2004-08-06 09:53:00 ID : CLA-2004:856 RELEVANT RELEASES : 8, 9, 10 - ------------------------------------------------------------------------- DESCRIPTION libpng[1] is a library for manipulating PNG image format files. Chris Evans found several vulnerabilities in unpatched libpng versions pior to 1.0.16rc1 and 1.2.6rc1: 1. Buffer overflow[2] vulnerabilities which could allow a remote attacker to execute arbitrary code via a malicious PNG image. 2. NULL-pointer reference[3] vulnerabilities that could allow a remote attacker to cause an application to crash via a malicious PNG image. 3. Integer overflow[4] vulnerabilities that could allow a remote attacker to cause an application to crash via a malicious PNG image. SOLUTION It is recommended that all Conectiva Linux users upgrade their packages. IMPORTANT: all applications linked against libpng must be restarted after the upgrade in order to close the vulnerabilities. REFERENCES 1.http://www.libpng.org/pub/png/libpng.html 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597 3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598 4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599 UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/10/SRPMS/libpng-1.0.15-42714U10_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/10/SRPMS/libpng3-1.2.5-57535U10_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/10/RPMS/libpng-devel-1.2.5-57535U10_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/10/RPMS/libpng-devel-static-1.2.5-57535U10_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/10/RPMS/libpng-doc-1.2.5-57535U10_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/10/RPMS/libpng10-1.0.15-42714U10_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/10/RPMS/libpng3-1.2.5-57535U10_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/SRPMS/libpng-1.0.14-1U80_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/SRPMS/libpng3-1.2.5-1U80_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/libpng-1.0.14-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/libpng-devel-1.2.5-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/libpng-devel-static-1.2.5-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/libpng-doc-1.2.5-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/libpng3-1.2.5-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/SRPMS/libpng-1.0.15-22380U90_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/9/SRPMS/libpng3-1.2.5-22618U90_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libpng-1.0.15-22380U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libpng-devel-1.2.5-22618U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libpng-devel-static-1.2.5-22618U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libpng-doc-1.2.5-22618U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libpng3-1.2.5-22618U90_1cl.i386.rpm ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades: - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions regarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- Copyright (c) 2004 Conectiva Inc. http://www.conectiva.com - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribe@...aleguas.conectiva.com.br unsubscribe: conectiva-updates-unsubscribe@...aleguas.conectiva.com.br -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQFBE39s42jd0JmAcZARAgrAAKDzrRaZG9UlMb2m+8ZAd5Z3MvdlMgCg2JFj nuNz0uDq8GINuC6yw5r6Pms= =gDab -----END PGP SIGNATURE-----
Powered by blists - more mailing lists