full-disclosure - GLSA: libpng

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20030108153301.D4C1633806@mail1.tamperd.net>
From: aliz at gentoo.org (Daniel Ahlberg)
Subject: GLSA:  libpng

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200301-7
- - --------------------------------------------------------------------

PACKAGE : libpng
SUMMARY : buffer overflow
DATE    : 2003-01-08 15:01 UTC
EXPLOIT : remote

- - --------------------------------------------------------------------

- From Debian Security Advisory DSA 213-1:

"Glenn Randers-Pehrson discovered a problem in connection with 16-bit
samples from libpng, an interface for reading and writing PNG
(Portable Network Graphics) format files.  The starting offsets for
the loops are calculated incorrectly which causes a buffer overrun
beyond the beginning of the row buffer."

Read the full advisory at
http://www.debian.org/security/2002/dsa-213

SOLUTION

It is recommended that all Gentoo Linux users who are running
media-libs/libpng-1.2.5-r1 or earlier update their systems as follows:

emerge rsync
emerge libpng

If you also have libpng-1.0.12-r1 or earlier installed update your 
system as follows:

emerge \=media-libs/libpng-1.0.12-r2

Finish with:

emerge clean

- - --------------------------------------------------------------------
aliz@...too.org - GnuPG key is available at www.gentoo.org/~aliz
- - --------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+HEShfT7nyhUpoZMRAvoiAKCKhtJz+FVEW84Zr+NDEQ5xYcqf7gCgxLZ8
teSWsNMM8ls6TU7MfX7/lyM=
=bhV+
-----END PGP SIGNATURE-----