Bug 201936 - libpng Graphics Library Chunk Error Processing Buffer Overflow
libpng Graphics Library Chunk Error Processing Buffer Overflow
Status: CLOSED WONTFIX
Product: Fedora Legacy
Classification: Retired
Component: libpng (Show other bugs)
rhl7.3
All Linux
medium Severity medium
: ---
: ---
Assigned To: Fedora Legacy Bugs
http://www.securityfocus.com/bid/1869...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-08-09 16:53 EDT by John Dalbec
Modified: 2008-05-01 11:38 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-08-30 15:57:06 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
libpng-1.2.8-CVE-2006-3334.patch (474 bytes, patch)
2006-08-27 14:19 EDT, jens.koerber
no flags Details | Diff

  None (edit)
Description John Dalbec 2006-08-09 16:53:54 EDT
06.26.12 CVE: Not Available
Platform: Linux
Title: libpng Graphics Library Chunk Error Processing Buffer Overflow
Description: libpng is the official Portable Network Graphics (PNG)
reference library. It is vulnerable to a buffer overflow issue when
handling malformed PNG files. libpng3 version 1.2.12 is not
vulnerable.
Ref: http://www.securityfocus.com/bid/18698/info

(3) HIGH: LibPNG Chunk Processing Buffer Overflow
Affected:
LibPNG versions 1.2.11 and prior
 
Description: LibPNG, a popular library for processing PNG (Portable
Network Graphics) images, is installed and used by default on all Linux,
UNIX, BSD, and Mac OS X systems. Certain applications may also install
the library on Windows systems. The library contains a buffer overflow
that can be triggered by a specially crafted PNG image "chunk". Any
application that delivers a malformed PNG image (web, email, IM) can
exploit the overflow to execute arbitrary code with the privileges of
the current user. Since LibPNG is open source, the technical details for
this exploit can be obtained by examining the fixed code.

Status: LibPNG confirmed, updates available.

Council Site Actions:  The responding council sites using the affected
software plan to install any patches that come out for OS or
applications they use within regular patching intervals.  One also said
they don't run graphical applications that take input from the outside
world on their UNIX systems.

References:
LibPNG Release Notes (contains vulnerability announcement)
http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=428123 
PNG File Format
http://www.w3.org/TR/PNG/ 
LibPNG Home Page
http://www.libpng.org/pub/png/   
SecurityFocus BID
http://www.securityfocus.com/bid/18698
Comment 1 jens.koerber 2006-08-27 14:19:04 EDT
Created attachment 135008 [details]
libpng-1.2.8-CVE-2006-3334.patch

>>
Comment 2 Jesse Keating 2007-08-30 15:57:06 EDT
Fedora Legacy project has ended.  These will not be fixed by Fedora Legacy.

Note You need to log in before you can comment on or make changes to this bug.