Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: libpng 1.2.5 was released last year in October and Fedora Development is hanging around 1.2.2. 1.2.5 contains lots of fixes to 1.2.4 and even mor to 1.2.2, for more have a look to ftp://swrinde.nde.swri.edu/pub/png/src/libpng-1.2.5-README.txt and to the changelog. Version-Release number of selected component (if applicable): libpng-1.2.2-19.1 Actual results: For me, a simple update to 1.2.5 worked very well. Expected results: Upgrade to 1.2.5 ;-)
Oops, I was such happy, that I wasn't forced to do patch merging, so I didn't saw the bad makefile solution... I wrote a patch (attached), that works for me perfect, that are my changes in the spec file: --- libpng.spec 2004-03-02 22:41:43.000000000 +0100 +++ libpng.spec.rsc 2004-04-27 19:49:26.000000000 +0200 @@ -1,12 +1,11 @@ Summary: A library of functions for manipulating PNG image format files. Name: libpng -Version: 1.2.2 -Release: 19.1 +Version: 1.2.5 +Release: 1 License: OSI certified Group: System Environment/Libraries Source: ftp://swrinde.nde.swri.edu/pub/png/src/libpng-%{version}.tar.bz2 -Source2: ftp://swrinde.nde.swri.edu/pub/png/src/libpng-1.2.2patch03-makefiles.tar.gz -Patch0: libpng-1.2.2-rhconf.patch +Patch0: libpng-1.2.5-rhconf.patch Patch1: libpng-1.0.9-badchunks.patch Patch2: libpng-1.2.2-libdirfix.patch Buildroot: %{_tmppath}/%{name}-%{version}-root @@ -43,8 +41,6 @@ %prep %setup -q -## dump in the fixed makefiles (remove this with 1.2.3, presumably) -(cd scripts && tar zxf %{SOURCE2}) ln -s scripts/makefile.linux Makefile %patch0 -p1 -b .rhconf @@ -58,15 +54,6 @@ rm -rf $RPM_BUILD_ROOT make install prefix=$RPM_BUILD_ROOT/usr LIBPATH=$RPM_BUILD_ROOT%{_libdir} -mkdir -p $RPM_BUILD_ROOT%{_mandir}/man{3,5} -install -c -m 644 *.3 $RPM_BUILD_ROOT%{_mandir}/man3 -install -c -m 644 *.5 $RPM_BUILD_ROOT%{_mandir}/man5 - -ln -s libpng12/png.h $RPM_BUILD_ROOT%{_includedir} -ln -s libpng12/pngconf.h $RPM_BUILD_ROOT%{_includedir} - -# I don't know what this is doing here. -rm -f $RPM_BUILD_ROOT%{_mandir}/man5/libpng.so* %post -p /sbin/ldconfig @@ -80,6 +67,7 @@ %files devel %defattr(-,root,root) +%{_bindir}/* %{_includedir}/* %{_libdir}/libpng*.a %{_libdir}/libpng*.so
Created attachment 99719 [details] libpng-1.2.5-rhconf.patch
Marking as enhancement as its too close to FC2 to go changing packages now
Here's a fix for CVE CAN-2004-0421 for libpng 1.2.5 that can be applied to the patch above. --- libpng.spec.rsc 2004-05-03 11:16:25.000000000 +0200 +++ libpng.spec.rsc2 2004-05-03 12:56:27.000000000 +0200 @@ -8,6 +8,7 @@ Patch0: libpng-1.2.5-rhconf.patch Patch1: libpng-1.0.9-badchunks.patch Patch2: libpng-1.2.2-libdirfix.patch +Patch3: libpng-1.2.5-oob_error_message.patch Buildroot: %{_tmppath}/%{name}-%{version}-root BuildPrereq: zlib-devel Provides: libpng.so.3 @@ -46,6 +47,7 @@ %patch0 -p1 -b .rhconf %patch1 -p1 -b .badchunk %patch2 -p1 -b .libdirfix +%patch3 -p1 -b .oob_error_message %build make ZLIBLIB=%{_libdir} RPM_OPT_FLAGS="$RPM_OPT_FLAGS" LIBPATH=%{_libdir}
Created attachment 99904 [details] libpng-1.2.5-oob_error_message.patch
Oh...I saw at current, that there is no fix for CVE CAN-2004-0421 for libpng 1.2.2 in the Fedora Development tree/Rawhide. So please solve this security issue either with a rebuild of the latest libpng from RH9/RHEL or use this solution.
*** Bug 122329 has been marked as a duplicate of this bug. ***
Created attachment 100245 [details] libpng-1.2.5-rhconf.patch Yeah, we've got to link against zlib using -lz
Created attachment 100246 [details] libpng-1.2.5-oob_error_message.patch Okay, we use the reworked patch also in 1.2.5
*** Bug 99052 has been marked as a duplicate of this bug. ***