Date: 29 Jun 2004 23:04:30 -0000
From: Mandrake Linux Security Team <[email protected]>
To: [email protected]Subject: MDKSA-2004:063 - Updated libpng packages fix potential remote compromise
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandrakelinux Security Update Advisory
_______________________________________________________________________
Package name: libpng
Advisory ID: MDKSA-2004:063
Date: June 29th, 2004
Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1,
Multi Network Firewall 8.2
______________________________________________________________________
Problem Description:
A buffer overflow vulnerability was discovered in libpng due to a wrong
calculation of some loop offset values. This buffer overflow can lead
to Denial of Service or even remote compromise.
This vulnerability was initially patched in January of 2003, but it
has since been noted that fixes were required in two additional places
that had not been corrected with the earlier patch. This update uses
an updated patch to fix all known issues.
After the upgrade, all applications that use libpng should be
restarted. Many applications are linked to libpng, so if you are
unsure of what applications to restart, you may wish to reboot the
system. Mandrakesoft encourages all users to upgrade immediately.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1363http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:008
______________________________________________________________________
Updated Packages:
Mandrakelinux 10.0:
b839285ba258d6e3ccb9d3825b766901 10.0/RPMS/libpng3-1.2.5-10.3.100mdk.i586.rpm
c014991a9204830f782f68254b622a61 10.0/RPMS/libpng3-devel-1.2.5-10.3.100mdk.i586.rpm
84a2c6d319d6bbaf9cf304b1e6075fb8 10.0/RPMS/libpng3-static-devel-1.2.5-10.3.100mdk.i586.rpm
3e33450632704e0c4578b8d37af2113e 10.0/SRPMS/libpng-1.2.5-10.3.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
af1dff46374070937fd9d62475de0254 amd64/10.0/RPMS/lib64png3-1.2.5-10.3.100mdk.amd64.rpm
e4d7de0a42cc27c9543e94bbb89aed80 amd64/10.0/RPMS/lib64png3-devel-1.2.5-10.3.100mdk.amd64.rpm
6e0f39bf485aab02b5791272e37a1c8e amd64/10.0/RPMS/lib64png3-static-devel-1.2.5-10.3.100mdk.amd64.rpm
3e33450632704e0c4578b8d37af2113e amd64/10.0/SRPMS/libpng-1.2.5-10.3.100mdk.src.rpm
Corporate Server 2.1:
e6056c15e8aee840f23fd724801c68c0 corporate/2.1/RPMS/libpng3-1.2.4-3.5.C21mdk.i586.rpm
a4800e9eedac026fb7a6a2ef43dcfd35 corporate/2.1/RPMS/libpng3-devel-1.2.4-3.5.C21mdk.i586.rpm
ca88a0013ce7c6b219b34482f29413f3 corporate/2.1/RPMS/libpng3-static-devel-1.2.4-3.5.C21mdk.i586.rpm
71fffcd387ae67bbd5b9ed3e3d8e37e3 corporate/2.1/SRPMS/libpng-1.2.4-3.5.C21mdk.src.rpm
Corporate Server 2.1/x86_64:
f01d40d1f4456b99b3e0b45ab9a75ad6 x86_64/corporate/2.1/RPMS/libpng3-1.2.4-3.5.C21mdk.x86_64.rpm
e0a8f3aebfdebd1f301dd6a609c3fb14 x86_64/corporate/2.1/RPMS/libpng3-devel-1.2.4-3.5.C21mdk.x86_64.rpm
aa5e793c0fcfde7acb582ca308eafaa6 x86_64/corporate/2.1/RPMS/libpng3-static-devel-1.2.4-3.5.C21mdk.x86_64.rpm
71fffcd387ae67bbd5b9ed3e3d8e37e3 x86_64/corporate/2.1/SRPMS/libpng-1.2.4-3.5.C21mdk.src.rpm
Mandrakelinux 9.1:
47b7136e0ffc87022f0c7b61ba180ede 9.1/RPMS/libpng3-1.2.5-2.3.91mdk.i586.rpm
8ef669612a5eac43f41cd0b7c9e23c86 9.1/RPMS/libpng3-devel-1.2.5-2.3.91mdk.i586.rpm
7f9b1b1f639fca07a38abdfa37d79c8b 9.1/RPMS/libpng3-static-devel-1.2.5-2.3.91mdk.i586.rpm
28d3472cfbd53a9b312281cfdb6351b9 9.1/SRPMS/libpng-1.2.5-2.3.91mdk.src.rpm
Mandrakelinux 9.1/PPC:
aa334eb90f70b4053db434b64089d35d ppc/9.1/RPMS/libpng3-1.2.5-2.3.91mdk.ppc.rpm
9e2a767d6fe67a949016d971e6c5bc46 ppc/9.1/RPMS/libpng3-devel-1.2.5-2.3.91mdk.ppc.rpm
7229990aa45e8584c005859db97144b2 ppc/9.1/RPMS/libpng3-static-devel-1.2.5-2.3.91mdk.ppc.rpm
28d3472cfbd53a9b312281cfdb6351b9 ppc/9.1/SRPMS/libpng-1.2.5-2.3.91mdk.src.rpm
Mandrakelinux 9.2:
715a708ef3c4f25ce94908558ca1b0a2 9.2/RPMS/libpng3-1.2.5-7.3.92mdk.i586.rpm
dbe789399e2034fe5a024ce7b6e9a3ed 9.2/RPMS/libpng3-devel-1.2.5-7.3.92mdk.i586.rpm
c79e966637991ab3520720f745f0a21e 9.2/RPMS/libpng3-static-devel-1.2.5-7.3.92mdk.i586.rpm
f4488ff6b1da53cd02a43658f541f6ec 9.2/SRPMS/libpng-1.2.5-7.3.92mdk.src.rpm
Mandrakelinux 9.2/AMD64:
222378f78f5047c7941b1d3d0ab82184 amd64/9.2/RPMS/lib64png3-1.2.5-7.3.92mdk.amd64.rpm
ed110a49ff14580d9e011a19d120c712 amd64/9.2/RPMS/lib64png3-devel-1.2.5-7.3.92mdk.amd64.rpm
30e005b0d91d77f21dce2833106f69a3 amd64/9.2/RPMS/lib64png3-static-devel-1.2.5-7.3.92mdk.amd64.rpm
f4488ff6b1da53cd02a43658f541f6ec amd64/9.2/SRPMS/libpng-1.2.5-7.3.92mdk.src.rpm
Multi Network Firewall 8.2:
49f7119cd8a449fb77ab32070b0f5843 mnf8.2/RPMS/libpng3-1.2.4-3.5.M82mdk.i586.rpm
a4b220d9b228cd6d0bac2854682f1a24 mnf8.2/SRPMS/libpng-1.2.4-3.5.M82mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFA4fV+mqjQ0CJFipgRAhwdAJ90L2Jn81wT4YoHYdtBu5BvlgZCDwCgqnDy
Lvn4WHT3I4jQ+6WeSADyJGo=
=o3tA
-----END PGP SIGNATURE-----
