Debian Security Advisory

[Tami]

Debian Security Advisory
DSA-570-1 libpng -- integer overflow

Date Reported:
20 Oct 2004
Affected Packages:
libpng
Vulnerable:
Yes
Security database references:
In Mitre\'s CVE dictionary: CAN-2004-0955.
More information:

Several integer overflows have been discovered by its upstream developers in libpng, a commonly used library to display PNG graphics. They could be exploited to cause arbitrary code to be executed when a specially crafted PNG image is processed.

For the stable distribution (woody) this problem has been fixed in version 1.0.12-3.woody.9.

For the unstable distribution (sid) this problem has been fixed in version 1.0.15-8.

We recommend that you upgrade your libpng packages.
Fixed in:
Debian GNU/Linux 3.0 (woody)

Source:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.0.12-3.woody.9.dsc\"]http://security.debian.org/pool/updates/ma...2-3.woody.9.dsc[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.0.12-3.woody.9.diff.gz\"]http://security.debian.org/pool/updates/ma...woody.9.diff.gz[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng_1.0.12.orig.tar.gz\"]http://security.debian.org/pool/updates/ma....12.orig.tar.gz[/url]
Alpha:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_alpha.deb\"]http://security.debian.org/pool/updates/ma...ody.9_alpha.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_alpha.deb\"]http://security.debian.org/pool/updates/ma...ody.9_alpha.deb[/url]
ARM:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_arm.deb\"]http://security.debian.org/pool/updates/ma...woody.9_arm.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_arm.deb\"]http://security.debian.org/pool/updates/ma...woody.9_arm.deb[/url]
Intel IA-32:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_i386.deb\"]http://security.debian.org/pool/updates/ma...oody.9_i386.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_i386.deb\"]http://security.debian.org/pool/updates/ma...oody.9_i386.deb[/url]
Intel IA-64:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_ia64.deb\"]http://security.debian.org/pool/updates/ma...oody.9_ia64.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_ia64.deb\"]http://security.debian.org/pool/updates/ma...oody.9_ia64.deb[/url]
HPPA:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_hppa.deb\"]http://security.debian.org/pool/updates/ma...oody.9_hppa.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_hppa.deb\"]http://security.debian.org/pool/updates/ma...oody.9_hppa.deb[/url]
Motorola 680x0:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_m68k.deb\"]http://security.debian.org/pool/updates/ma...oody.9_m68k.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_m68k.deb\"]http://security.debian.org/pool/updates/ma...oody.9_m68k.deb[/url]
Big endian MIPS:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_mips.deb\"]http://security.debian.org/pool/updates/ma...oody.9_mips.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_mips.deb\"]http://security.debian.org/pool/updates/ma...oody.9_mips.deb[/url]
Little endian MIPS:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_mipsel.deb\"]http://security.debian.org/pool/updates/ma...dy.9_mipsel.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_mipsel.deb\"]http://security.debian.org/pool/updates/ma...dy.9_mipsel.deb[/url]
PowerPC:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_powerpc.deb\"]http://security.debian.org/pool/updates/ma...y.9_powerpc.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_powerpc.deb\"]http://security.debian.org/pool/updates/ma...y.9_powerpc.deb[/url]
IBM S/390:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_s390.deb\"]http://security.debian.org/pool/updates/ma...oody.9_s390.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_s390.deb\"]http://security.debian.org/pool/updates/ma...oody.9_s390.deb[/url]
Sun Sparc:
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2_1.0.12-3.woody.9_sparc.deb\"]http://security.debian.org/pool/updates/ma...ody.9_sparc.deb[/url]
[url=\"http://security.debian.org/pool/updates/main/libp/libpng/libpng2-dev_1.0.12-3.woody.9_sparc.deb\"]http://security.debian.org/pool/updates/ma...ody.9_sparc.deb[/url]

MD5 checksums of the listed files are available in the original [url=\"http://lists.debian.org/debian-security-announce/debian-security-announce-2004/msg00179.html\"]advisory[/url].