Date: Wed, 8 Jan 2003 16:33:00 +0100
From: Daniel Ahlberg <aliz@gentoo.org>
To: bugtraq@securityfocus.com
Subject: GLSA: libpng
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200301-7
- - --------------------------------------------------------------------
PACKAGE : libpng
SUMMARY═: buffer overflow
DATE ══ : 2003-01-08 15:01 UTC
EXPLOIT : remote
- - --------------------------------------------------------------------
- From Debian Security Advisory DSA 213-1:
"Glenn Randers-Pehrson discovered a problem in connection with 16-bit
samples from libpng, an interface for reading and writing PNG
(Portable Network Graphics) format files. The starting offsets for
the loops are calculated incorrectly which causes a buffer overrun
beyond the beginning of the row buffer."
Read the full advisory at
http://www.debian.org/security/2002/dsa-213
SOLUTION
It is recommended that all Gentoo Linux users who are running
media-libs/libpng-1.2.5-r1 or earlier update their systems as follows:
emerge rsync
emerge libpng
If you also have libpng-1.0.12-r1 or earlier installed update your
system as follows:
emerge \=media-libs/libpng-1.0.12-r2
Finish with:
emerge clean
- - --------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
- - --------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+HEShfT7nyhUpoZMRAvoiAKCKhtJz+FVEW84Zr+NDEQ5xYcqf7gCgxLZ8
teSWsNMM8ls6TU7MfX7/lyM=
=bhV+
-----END PGP SIGNATURE-----
