Bug 1179186 (CVE-2014-9495)

Summary:	CVE-2014-9495 libpng: buffer overflow in png_combine_row
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	phracek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libpng 1.5.21, libpng 1.6.16	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-01-07 04:40:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1179188, 1179189
Bug Blocks:	1179187

Description Vasyl Kaigorodov 2015-01-06 12:07:34 UTC

It was reported [1] that libpng versions 1.6.9-1.6.15 contain heap overflow vulnerability, that under certain circumstances [2] can allow a controlled write.
Other versions of libpng might be vulnerable as well.

This looks like the upstream commit that fixes this:
http://sourceforge.net/p/libpng/code/ci/dc294204b641373bc6eb603075a8b98f51a75dd8/

[1]: http://seclists.org/oss-sec/2015/q1/31
[2]: http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt

Comment 1 Vasyl Kaigorodov 2015-01-06 12:11:44 UTC

Created libpng tracking bugs for this issue:

Affects: fedora-all [bug 1179188]

Comment 2 Vasyl Kaigorodov 2015-01-06 12:11:46 UTC

Created libpng15 tracking bugs for this issue:

Affects: fedora-all [bug 1179189]

Comment 3 Huzaifa S. Sidhpurwala 2015-01-07 04:40:27 UTC


*** This bug has been marked as a duplicate of bug 1177327 ***

Comment 4 Huzaifa S. Sidhpurwala 2015-01-07 09:23:31 UTC

Statement:

Not vulnerable. This issue does not affect the version of libpng as shipped with Red Hat Enterprise Linux 5, 6 and 7. For a more detailed explanation please refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1177327#c1

Comment 5 Fedora Update System 2015-03-09 08:19:20 UTC

libpng10-1.0.63-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-03-09 08:28:25 UTC

libpng10-1.0.63-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-03-09 08:37:22 UTC

libpng10-1.0.63-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2015-03-15 00:59:35 UTC

libpng10-1.0.63-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.