Red Hat Bugzilla – Bug 201936
libpng Graphics Library Chunk Error Processing Buffer Overflow
Last modified: 2008-05-01 11:38:06 EDT
06.26.12 CVE: Not Available Platform: Linux Title: libpng Graphics Library Chunk Error Processing Buffer Overflow Description: libpng is the official Portable Network Graphics (PNG) reference library. It is vulnerable to a buffer overflow issue when handling malformed PNG files. libpng3 version 1.2.12 is not vulnerable. Ref: http://www.securityfocus.com/bid/18698/info (3) HIGH: LibPNG Chunk Processing Buffer Overflow Affected: LibPNG versions 1.2.11 and prior Description: LibPNG, a popular library for processing PNG (Portable Network Graphics) images, is installed and used by default on all Linux, UNIX, BSD, and Mac OS X systems. Certain applications may also install the library on Windows systems. The library contains a buffer overflow that can be triggered by a specially crafted PNG image "chunk". Any application that delivers a malformed PNG image (web, email, IM) can exploit the overflow to execute arbitrary code with the privileges of the current user. Since LibPNG is open source, the technical details for this exploit can be obtained by examining the fixed code. Status: LibPNG confirmed, updates available. Council Site Actions: The responding council sites using the affected software plan to install any patches that come out for OS or applications they use within regular patching intervals. One also said they don't run graphical applications that take input from the outside world on their UNIX systems. References: LibPNG Release Notes (contains vulnerability announcement) http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=428123 PNG File Format http://www.w3.org/TR/PNG/ LibPNG Home Page http://www.libpng.org/pub/png/ SecurityFocus BID http://www.securityfocus.com/bid/18698
Created attachment 135008 [details] libpng-1.2.8-CVE-2006-3334.patch >>
Fedora Legacy project has ended. These will not be fixed by Fedora Legacy.