BLAG

BLAG Forums
It is currently Fri Dec 19, 2014 10:12 am

All times are UTC




Post new topic Reply to topic  [ 1 post ] 
Author Message
PostPosted: Sat Mar 05, 2005 2:26 am 
Offline

Joined: Mon Mar 15, 2004 8:17 pm
Posts: 415
Location: ny
———————————————————————–
Fedora Legacy Update Advisory

Synopsis: Updated libpng resolves security vulnerabilities
Advisory ID: FLSA:1943
Issue date: 2005-02-08
Product: Red Hat Linux
Fedora Core
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1943
https://bugzilla.fedora.us/show_bug.cgi?id=1550
CVE Names: CVE-2002-1363, CAN-2004-0597, CAN-2004-0598,
CAN-2004-0599, CAN-2004-0768
———————————————————————–

———————————————————————–
1. Topic:

Updated libpng packages that fix security vulnerabilities are now
available.

The libpng package contains a library of functions for creating and
manipulating PNG (Portable Network Graphics) image format files. PNG
is a bit-mapped graphics format similar to the GIF format. PNG was
created to replace the GIF format, since GIF uses a patented data
compression algorithm.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386

3. Problem description:

During a source code audit, Chris Evans discovered several buffer overflows
in libpng. An attacker could create a carefully crafted PNG file in such a
way that it would cause an application linked with libpng to execute
arbitrary code when the file was opened by a victim. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0597 to these issues.

In addition, this audit discovered a potential NULL pointer dereference in
libpng (CAN-2004-0598) and several integer overflow issues (CAN-2004-0599).
An attacker could create a carefully crafted PNG file in such a way that
it would cause an application linked with libpng to crash when the file was
opened by the victim.

These patches also include a more complete fix for the out of bounds memory
access flaw (CVE-2002-1363), in which there was a buffer overrun while adding
filler bytes to 16-bit RGBA samples, and a similar patch (CAN-2004-0768) that
fixes a buffer overrun while adding filler bytes to 16-bit grayscale samples.

All users are advised to update to the updated libpng packages which
contain backported security patches and are not vulnerable to these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system. This assumes that you have yum or
apt-get configured for obtaining Fedora Legacy content. Please visit
http://www.fedoralegacy.org/docs/ for directions on how to configure yum
and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1943 - CAN-2004-0597to0599 libpng buffer overflows

6. RPMs required:

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat ... cy.src.rpm
http://download.fedoralegacy.org/redhat ... cy.src.rpm

i386:
http://download.fedoralegacy.org/redhat ... y.i386.rpm
http://download.fedoralegacy.org/redhat ... y.i386.rpm
http://download.fedoralegacy.org/redhat ... y.i386.rpm
http://download.fedoralegacy.org/redhat ... y.i386.rpm

7. Verification:

SHA1 sum Package Name
—————————————————————————

cdd4dd5844581c8aa9b16e9738f9529f77a9804d redhat/9/updates/SRPMS/libpng10-1.0.15-0.9.1.legacy.src.rpm
be705f7823d379c5c99f88f4b2c2364e333379cb redhat/9/updates/SRPMS/libpng-1.2.2-20.3.legacy.src.rpm
d71f34a57a80386cdbe2bc9738f0e2b778c639e7 redhat/9/updates/i386/libpng10-1.0.15-0.9.1.legacy.i386.rpm
e89ca650e1839e4ad3155097cf6c70e239befe7c redhat/9/updates/i386/libpng10-devel-1.0.15-0.9.1.legacy.i386.rpm
7cd0d3d36280449e6cb0fe1b4478d14701ec11c5 redhat/9/updates/i386/libpng-1.2.2-20.3.legacy.i386.rpm
36ddbdaac4cc3ec1f9e23521a0ad1029714a80a2 redhat/9/updates/i386/libpng-devel-1.2.2-20.3.legacy.i386.rpm

These packages are GPG signed by Fedora Legacy for security. Our key is
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

rpm –checksig -v

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

sha1sum

8. References:

https://rhn.redhat.com/errata/RHSA-2004-402.html


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 

All times are UTC


Who is online

Users browsing this forum: No registered users and 0 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group