Skip to navigation

Security Advisory libpng security update

Advisory: RHSA-2004:402-08
Type: Security Advisory
Severity: Critical
Issued on: 2004-08-04
Last updated on: 2004-08-04
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 2.1)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 2.1)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 2.1)
Red Hat Enterprise Linux WS (v. 3)
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
CVEs (cve.mitre.org): CVE-2002-1363
CVE-2004-0597
CVE-2004-0598
CVE-2004-0599

Details

Updated libpng packages that fix several issues are now available.

The libpng package contains a library of functions for creating and
manipulating PNG (Portable Network Graphics) image format files.

During a source code audit, Chris Evans discovered several buffer overflows
in libpng. An attacker could create a carefully crafted PNG file in such a
way that it would cause an application linked with libpng to execute
arbitrary code when the file was opened by a victim. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0597 to these issues.

In addition, this audit discovered a potential NULL pointer dereference in
libpng (CAN-2004-0598) and several integer overflow issues (CAN-2004-0599).
An attacker could create a carefully crafted PNG file in such a way that
it would cause an application linked with libpng to crash when the file was
opened by the victim.

Red Hat would like to thank Chris Evans for discovering these issues.

For users of Red Hat Enterprise Linux 2.1 these patches also include a more
complete fix for the out of bounds memory access flaw (CAN-2002-1363).

All users are advised to update to the updated libpng packages which
contain backported security patches and are not vulnerable to these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Desktop (v. 3)

SRPMS:
libpng-1.2.2-25.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1555047a805d476f63b705865ec6b1a1
libpng-1.2.2-25.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1555047a805d476f63b705865ec6b1a1
libpng10-1.0.13-15.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1a1c918f5d8054158036ff82bd6c8bc2
libpng10-1.0.13-15.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1a1c918f5d8054158036ff82bd6c8bc2
 
IA-32:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-devel-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: a79e3d8aac72561af368e5655c9dcb13
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-devel-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 347af31b8620742e5e6b18de0c300d62
 
x86_64:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-1.2.2-25.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 80265ad8a377cf67f2906994e7b763af
libpng-devel-1.2.2-25.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 188fec715d9a2129f28c775ad3917f7a
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-1.0.13-15.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 006b451f489d3ec09ad39d23099ea0fb
libpng10-devel-1.0.13-15.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: e9a385e6c6c14d7575d84f045b01c054
 
Red Hat Enterprise Linux AS (v. 2.1)

SRPMS:
libpng-1.0.14-7.src.rpm
File outdated by:  RHSA-2009:0333
    MD5: 69bba6610f415bd0f21f815db1effbf2
libpng-1.0.14-7.src.rpm
File outdated by:  RHSA-2009:0333
    MD5: 69bba6610f415bd0f21f815db1effbf2
 
IA-32:
libpng-1.0.14-7.i386.rpm
File outdated by:  RHSA-2009:0333
    MD5: c660a4e7c583306a46a0134ab104f346
libpng-devel-1.0.14-7.i386.rpm
File outdated by:  RHSA-2009:0333
    MD5: 7b2588d5cc492eb84a1c73729303ca4e
 
IA-64:
libpng-1.0.14-7.ia64.rpm
File outdated by:  RHSA-2009:0333
    MD5: 86e364114c5dedb33c5252b9a3fe6211
libpng-devel-1.0.14-7.ia64.rpm
File outdated by:  RHSA-2009:0333
    MD5: 5201c1e26319d34fb8efa09256007152
 
Red Hat Enterprise Linux AS (v. 3)

SRPMS:
libpng-1.2.2-25.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1555047a805d476f63b705865ec6b1a1
libpng-1.2.2-25.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1555047a805d476f63b705865ec6b1a1
libpng10-1.0.13-15.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1a1c918f5d8054158036ff82bd6c8bc2
libpng10-1.0.13-15.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1a1c918f5d8054158036ff82bd6c8bc2
 
IA-32:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-devel-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: a79e3d8aac72561af368e5655c9dcb13
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-devel-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 347af31b8620742e5e6b18de0c300d62
 
IA-64:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-1.2.2-25.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 85c1fa0360af727b4b427aaac90861b7
libpng-devel-1.2.2-25.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 5800ad160885273f270a6b8ecd0b9373
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-1.0.13-15.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 811109452021a7f0bc9d25437caeab97
libpng10-devel-1.0.13-15.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: ba359cdb3db036a5b5b45c1a01b21791
 
PPC:
libpng-1.2.2-25.ppc.rpm
File outdated by:  RHSA-2010:0534
    MD5: cbf5617d15939c413b520fcbe0594485
libpng-1.2.2-25.ppc64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 5c7387ae952fcc1d4637e2655c9370a3
libpng-devel-1.2.2-25.ppc.rpm
File outdated by:  RHSA-2010:0534
    MD5: ddd78dd4e3439cb6cb28e5215e029a81
libpng10-1.0.13-15.ppc.rpm
File outdated by:  RHSA-2010:0534
    MD5: b0810e3f95590836652144165cd7e0cc
libpng10-devel-1.0.13-15.ppc.rpm
File outdated by:  RHSA-2010:0534
    MD5: d073fbeeef6874e0ae2238c6ef44ed6e
 
s390:
libpng-1.2.2-25.s390.rpm
File outdated by:  RHSA-2010:0534
    MD5: 0f621fbc3de1d8e4c4490e2baf2f30ef
libpng-devel-1.2.2-25.s390.rpm
File outdated by:  RHSA-2010:0534
    MD5: aec3463a236eac2d6d6576120f92eb55
libpng10-1.0.13-15.s390.rpm
File outdated by:  RHSA-2010:0534
    MD5: b4c3c6ee6d699fd51baf9f06f9275443
libpng10-devel-1.0.13-15.s390.rpm
File outdated by:  RHSA-2010:0534
    MD5: afb0ebe6e191e7f71929d30788a11708
 
s390x:
libpng-1.2.2-25.s390.rpm
File outdated by:  RHSA-2010:0534
    MD5: 0f621fbc3de1d8e4c4490e2baf2f30ef
libpng-1.2.2-25.s390x.rpm
File outdated by:  RHSA-2010:0534
    MD5: f218fb58aee3535f3f0280c6c6a78dfa
libpng-devel-1.2.2-25.s390x.rpm
File outdated by:  RHSA-2010:0534
    MD5: 50d5ecfe73aa1f3a7ef0c41fb8fb79c6
libpng10-1.0.13-15.s390.rpm
File outdated by:  RHSA-2010:0534
    MD5: b4c3c6ee6d699fd51baf9f06f9275443
libpng10-1.0.13-15.s390x.rpm
File outdated by:  RHSA-2010:0534
    MD5: 4b2733ffcb3d84295dcfecc36e69faaa
libpng10-devel-1.0.13-15.s390x.rpm
File outdated by:  RHSA-2010:0534
    MD5: edf03becdf0b2a6044c85896a005e1c3
 
x86_64:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-1.2.2-25.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 80265ad8a377cf67f2906994e7b763af
libpng-devel-1.2.2-25.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 188fec715d9a2129f28c775ad3917f7a
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-1.0.13-15.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 006b451f489d3ec09ad39d23099ea0fb
libpng10-devel-1.0.13-15.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: e9a385e6c6c14d7575d84f045b01c054
 
Red Hat Enterprise Linux ES (v. 2.1)

SRPMS:
libpng-1.0.14-7.src.rpm
File outdated by:  RHSA-2009:0333
    MD5: 69bba6610f415bd0f21f815db1effbf2
libpng-1.0.14-7.src.rpm
File outdated by:  RHSA-2009:0333
    MD5: 69bba6610f415bd0f21f815db1effbf2
 
IA-32:
libpng-1.0.14-7.i386.rpm
File outdated by:  RHSA-2009:0333
    MD5: c660a4e7c583306a46a0134ab104f346
libpng-devel-1.0.14-7.i386.rpm
File outdated by:  RHSA-2009:0333
    MD5: 7b2588d5cc492eb84a1c73729303ca4e
 
Red Hat Enterprise Linux ES (v. 3)

SRPMS:
libpng-1.2.2-25.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1555047a805d476f63b705865ec6b1a1
libpng-1.2.2-25.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1555047a805d476f63b705865ec6b1a1
libpng10-1.0.13-15.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1a1c918f5d8054158036ff82bd6c8bc2
libpng10-1.0.13-15.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1a1c918f5d8054158036ff82bd6c8bc2
 
IA-32:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-devel-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: a79e3d8aac72561af368e5655c9dcb13
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-devel-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 347af31b8620742e5e6b18de0c300d62
 
IA-64:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-1.2.2-25.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 85c1fa0360af727b4b427aaac90861b7
libpng-devel-1.2.2-25.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 5800ad160885273f270a6b8ecd0b9373
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-1.0.13-15.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 811109452021a7f0bc9d25437caeab97
libpng10-devel-1.0.13-15.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: ba359cdb3db036a5b5b45c1a01b21791
 
x86_64:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-1.2.2-25.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 80265ad8a377cf67f2906994e7b763af
libpng-devel-1.2.2-25.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 188fec715d9a2129f28c775ad3917f7a
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-1.0.13-15.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 006b451f489d3ec09ad39d23099ea0fb
libpng10-devel-1.0.13-15.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: e9a385e6c6c14d7575d84f045b01c054
 
Red Hat Enterprise Linux WS (v. 2.1)

SRPMS:
libpng-1.0.14-7.src.rpm
File outdated by:  RHSA-2009:0333
    MD5: 69bba6610f415bd0f21f815db1effbf2
libpng-1.0.14-7.src.rpm
File outdated by:  RHSA-2009:0333
    MD5: 69bba6610f415bd0f21f815db1effbf2
 
IA-32:
libpng-1.0.14-7.i386.rpm
File outdated by:  RHSA-2009:0333
    MD5: c660a4e7c583306a46a0134ab104f346
libpng-devel-1.0.14-7.i386.rpm
File outdated by:  RHSA-2009:0333
    MD5: 7b2588d5cc492eb84a1c73729303ca4e
 
Red Hat Enterprise Linux WS (v. 3)

SRPMS:
libpng-1.2.2-25.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1555047a805d476f63b705865ec6b1a1
libpng-1.2.2-25.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1555047a805d476f63b705865ec6b1a1
libpng10-1.0.13-15.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1a1c918f5d8054158036ff82bd6c8bc2
libpng10-1.0.13-15.src.rpm
File outdated by:  RHSA-2010:0534
    MD5: 1a1c918f5d8054158036ff82bd6c8bc2
 
IA-32:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-devel-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: a79e3d8aac72561af368e5655c9dcb13
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-devel-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 347af31b8620742e5e6b18de0c300d62
 
IA-64:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-1.2.2-25.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 85c1fa0360af727b4b427aaac90861b7
libpng-devel-1.2.2-25.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 5800ad160885273f270a6b8ecd0b9373
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-1.0.13-15.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 811109452021a7f0bc9d25437caeab97
libpng10-devel-1.0.13-15.ia64.rpm
File outdated by:  RHSA-2010:0534
    MD5: ba359cdb3db036a5b5b45c1a01b21791
 
x86_64:
libpng-1.2.2-25.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 63095ed0286c8978349ae94621887651
libpng-1.2.2-25.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 80265ad8a377cf67f2906994e7b763af
libpng-devel-1.2.2-25.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 188fec715d9a2129f28c775ad3917f7a
libpng10-1.0.13-15.i386.rpm
File outdated by:  RHSA-2010:0534
    MD5: 12464295e19c16d1474d1132bc90216e
libpng10-1.0.13-15.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: 006b451f489d3ec09ad39d23099ea0fb
libpng10-devel-1.0.13-15.x86_64.rpm
File outdated by:  RHSA-2010:0534
    MD5: e9a385e6c6c14d7575d84f045b01c054
 
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor

SRPMS:
libpng-1.0.14-7.src.rpm
File outdated by:  RHSA-2009:0333
    MD5: 69bba6610f415bd0f21f815db1effbf2
libpng-1.0.14-7.src.rpm
File outdated by:  RHSA-2009:0333
    MD5: 69bba6610f415bd0f21f815db1effbf2
 
IA-64:
libpng-1.0.14-7.ia64.rpm
File outdated by:  RHSA-2009:0333
    MD5: 86e364114c5dedb33c5252b9a3fe6211
libpng-devel-1.0.14-7.ia64.rpm
File outdated by:  RHSA-2009:0333
    MD5: 5201c1e26319d34fb8efa09256007152
 

References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/