It was reported [1] that libpng versions 1.6.9-1.6.15 contain heap overflow vulnerability, that under certain circumstances [2] can allow a controlled write. Other versions of libpng might be vulnerable as well. This looks like the upstream commit that fixes this: http://sourceforge.net/p/libpng/code/ci/dc294204b641373bc6eb603075a8b98f51a75dd8/ [1]: http://seclists.org/oss-sec/2015/q1/31 [2]: http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt
Created libpng tracking bugs for this issue: Affects: fedora-all [bug 1179188]
Created libpng15 tracking bugs for this issue: Affects: fedora-all [bug 1179189]
*** This bug has been marked as a duplicate of bug 1177327 ***
Statement: Not vulnerable. This issue does not affect the version of libpng as shipped with Red Hat Enterprise Linux 5, 6 and 7. For a more detailed explanation please refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1177327#c1
libpng10-1.0.63-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
libpng10-1.0.63-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
libpng10-1.0.63-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
libpng10-1.0.63-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.