A memory leak was found in the way libpng, PNG image format files manipulating library, processed image files with negative length of embedded International Color Consortium (ICC) profile chunk. A remote attacker could provide a specially-crafted JPEG image format file and trick the local user into opening it with an application linked against libpng, which would result in denial of service (excessive memory consumption or that particular application crash). References: [1] http://www.openwall.com/lists/oss-security/2011/03/22/7 (CVE Request)
As noted in [1]: i), the bug was introduced in 1.2.13beta1: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=0ff85c6923d2c4fca4ac0bad28e387e3b1777d7a#patch19 ii), and finally fixed in 1.2.39beta5: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9e88fcd58c8ce7f2183bc2045e5180cba0043f09#patch19
This issue did NOT affect the version of the libpng10 package, as shipped with Red Hat Enterprise Linux 4. This issue did NOT affect the versions of the libpng package, as shipped with Red Hat Enterprise Linux 4, 5, and 6. -- This issue did NOT affect the versions of the libpng10 package, as shipped with Fedora release of 13 and 14 and as present within EPEL-6 repository, as they already contain a fix for the issue. This issue did NOT affect the versions of the libpng package, as shipped with Fedora release of 13 and 14, as they already include the fix for the issue.
For completeness, it's also worth noting that there is no EPEL-5 package of libpng10, nor was it shipped with Red Hat Enterprise Linux 5.
In the current RHEL4 and RHEL5 packages, the embedded profile length is simply ignored. While that might be a bug in itself, there's no security impact AFAICS.
Statement: These flaws do not affect any version of libpng shipped with Red Hat Enterprise Linux.