Bug 324771 (CVE-2007-5269)

Summary:	CVE-2007-5269 libpng DoS via multiple out-of-bounds reads
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kreilly, tgl
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5269
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-12-20 12:07:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	337461, 337471, 337481, 337491, 337501, 337511, 337521, 337531, 337551, 337561, 337571, 537849, 802163
Bug Blocks:

Description Tomas Hoger 2007-10-09 12:10:33 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-5269 to the following vulnerability:

Certain chunk handlers in libpng before 1.0.29 and 1.2.x before 1.2.21
allow remote attackers to cause a denial of service (crash) via
crafted (1) pCAL (png_handle_pCAL), (2) sCAL (png_handle_sCAL), (3)
tEXt (png_push_read_tEXt), (4) iTXt (png_handle_iTXt), and (5) ztXT
(png_handle_ztXt) chunking in PNG images, which trigger out-of-bounds
read operations.

http://secunia.com/advisories/27093
http://www.frsirt.com/english/advisories/2007/3390
http://sourceforge.net/mailarchive/forum.php?thread_name=3.0.6.32.20071004082318.012a7628%40mail.comcast.net&forum_name=png-mng-implement

Comment 9 Tomas Hoger 2007-12-20 12:07:40 UTC

Fixed in all affected products:

Red Hat Enterprise Linux
  http://rhn.redhat.com/errata/RHSA-2007-0992.html

Fedora
  FEDORA-2007-734
  https://admin.fedoraproject.org/updates/F7/FEDORA-2007-2666
  https://admin.fedoraproject.org/updates/F7/FEDORA-2007-2521