[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[linux-security] remote exploit in linpng

Topic
=====
Remote exploit in libpng libraries.

Problem Description
===================
The libpng package contains a library of functions for creating and
manipulating PNG (Portable Network Graphics) image format files.  PNG
is a bit-mapped graphics format similar to the GIF format.
Several buffer overflows exist in libpng. An attacker could create a
carefully crafted PNG file in such a way that it would cause an application 
linked with libpng to execute arbitrary code when the file was opened by a
victim (CAN-2004-0597, CAN-2004-0598, CAN-2004-0599).
An exploit for this vulnerability has been published!

Affected Versions
=================
libpng-1.2.x with x < 6 and libpng-1.0.y with y < 16.

Solution
========
Upgrade to libpng-1.2.6 or libpng-1.0.16 or a patched version for your
distribution.

SuSE-8.0
--------
rpm -Fvh libpng-2.1.0.12-169.i386.rpm

SuSE-8.1
--------
rpm -Fvh libpng-1.2.4-115.i586.rpm

SuSE-8.2
--------
rpm -Fvh libpng-1.2.5-191.i586.rpm

SuSE-9.0
--------
rpm -Fvh libpng-1.2.5-191.i586.rpm

SuSE-9.1
--------
rpm -Fvh libpng-1.2.5-182.7.i586.rpm

SFU-1.0 (RedHat 7.3)
--------------------
[packages available from ftp://ftp.sfu.ca/pub/linux/7.3/RPMS/]

rpm -Fvh libpng-1.0.14-2.7.i386.rpm  libpng-devel-1.0.14-2.7.i386.rpm

Debian 3.0 (woody)
------------------
upgrade to libpng2_1.0.12-3.woody.7_i386.deb,
           libpng2-dev_1.0.12-3.woody.7_i386.deb,
           libpng3_1.2.1-1.1.woody.7_i386.deb,
           libpng-dev_1.2.1-1.1.woody.7_i386.deb

Mandrake 9.1
------------
rpm -Fvh libpng3-1.2.5-2.3.91mdk.i586.rpm \
         libpng3-devel-1.2.5-2.3.91mdk.i586.rpm \
         libpng3-static-devel-1.2.5-2.3.91mdk.i586.rpm

Mandrake 9.2
------------
rpm -Fvh libpng3-1.2.5-7.3.92mdk.i586.rpm \
         libpng3-devel-1.2.5-7.3.92mdk.i586.rpm \
         libpng3-static-devel-1.2.5-7.3.92mdk.i586.rpm

Mandrake 10.0
-------------
rpm -Fvh libpng3-1.2.5-10.3.100mdk.i586.rpm \
         libpng3-devel-1.2.5-10.3.100mdk.i586.rpm \
         libpng3-static-devel-1.2.5-10.3.100mdk.i586.rpm

Fedora Core 1
-------------
rpm -Fvh libpng-1.2.5-7.i386.rpm libpng-devel-1.2.5-7.i386.rpm \
         libpng10-1.0.15-7.i386.rpm libpng10-devel-1.0.15-7.i386.rpm

Fedora Core 2
-------------
rpm -Fvh libpng-1.2.5-8.i386.rpm libpng-devel-1.2.5-8.i386.rpm