exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2011-151

Mandriva Linux Security Advisory 2011-151
Posted Oct 17, 2011
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-151 - Multiple vulnerabilities has been discovered and corrected in libpng. The png_format_buffer function in pngerror.c in libpng allows remote attackers to cause a denial of service via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. Buffer overflow in libpng, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image. Various other issues were also addressed.

tags | advisory, remote, denial of service, overflow, arbitrary, vulnerability
systems | linux, mandriva
advisories | CVE-2011-2501, CVE-2011-2690, CVE-2011-2691, CVE-2011-2692
SHA-256 | acad0dfc8bb292aee7ddbc1a0ce9f17fb2448351051f964814c33efc660c99c8

Mandriva Linux Security Advisory 2011-151

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2011:151
http://www.mandriva.com/security/
_______________________________________________________________________

Package : libpng
Date : October 17, 2011
Affected: 2010.1, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in libpng:

The png_format_buffer function in pngerror.c in libpng allows
remote attackers to cause a denial of service (application crash)
via a crafted PNG image that triggers an out-of-bounds read during
the copying of error-message data. NOTE: this vulnerability exists
because of a CVE-2004-0421 regression (CVE-2011-2501).

Buffer overflow in libpng, when used by an application that calls the
png_rgb_to_gray function but not the png_set_expand function, allows
remote attackers to overwrite memory with an arbitrary amount of data,
and possibly have unspecified other impact, via a crafted PNG image
(CVE-2011-2690).

The png_err function in pngerror.c in libpng makes a function call
using a NULL pointer argument instead of an empty-string argument,
which allows remote attackers to cause a denial of service (application
crash) via a crafted PNG image (CVE-2011-2691). NOTE: This does not
affect the binary packages in Mandriva, but could affect users if
PNG_NO_ERROR_TEXT is defined using the libpng-source-1.?.?? package.

The png_handle_sCAL function in pngrutil.c in libpng does not properly
handle invalid sCAL chunks, which allows remote attackers to cause
a denial of service (memory corruption and application crash) or
possibly have unspecified other impact via a crafted PNG image that
triggers the reading of uninitialized memory (CVE-2011-2692).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2501
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2690
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2691
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2692
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.1:
75cf5cc9e56f7cd3c621ea2ba8899df3 2010.1/i586/libpng3-1.2.43-1.2mdv2010.2.i586.rpm
af2f3f6696d67efd19d2bf7cc30207da 2010.1/i586/libpng-devel-1.2.43-1.2mdv2010.2.i586.rpm
5190271f8394e5114aeb3b9de6a679bc 2010.1/i586/libpng-source-1.2.43-1.2mdv2010.2.i586.rpm
3d7b05502fd2c613f6e263c2bc4baf51 2010.1/i586/libpng-static-devel-1.2.43-1.2mdv2010.2.i586.rpm
4d26abf5f53ddfb40af4432b2ffe7215 2010.1/SRPMS/libpng-1.2.43-1.2mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
3a8041586d3f6a3666231ec9744efa30 2010.1/x86_64/lib64png3-1.2.43-1.2mdv2010.2.x86_64.rpm
3baefc4e0b5f560382ef411349142810 2010.1/x86_64/lib64png-devel-1.2.43-1.2mdv2010.2.x86_64.rpm
63db8d8b4313907f1b7d18ac4cf7c30f 2010.1/x86_64/lib64png-static-devel-1.2.43-1.2mdv2010.2.x86_64.rpm
bb8d9ac1982ae3591e701f1e32193733 2010.1/x86_64/libpng-source-1.2.43-1.2mdv2010.2.x86_64.rpm
4d26abf5f53ddfb40af4432b2ffe7215 2010.1/SRPMS/libpng-1.2.43-1.2mdv2010.2.src.rpm

Mandriva Enterprise Server 5:
2dc72977964282d6b9b71f02daf11875 mes5/i586/libpng3-1.2.31-2.4mdvmes5.2.i586.rpm
3a7a29b3ce673a6023b2ebd69702de77 mes5/i586/libpng-devel-1.2.31-2.4mdvmes5.2.i586.rpm
311e83f11ecca6e10492be05e93af450 mes5/i586/libpng-source-1.2.31-2.4mdvmes5.2.i586.rpm
6e78659cd2132ab936672d26307508c3 mes5/i586/libpng-static-devel-1.2.31-2.4mdvmes5.2.i586.rpm
7716bbc53dbf07a4bcf647d19c872321 mes5/SRPMS/libpng-1.2.31-2.4mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
30fbcd1e778a334751efb67347896a74 mes5/x86_64/lib64png3-1.2.31-2.4mdvmes5.2.x86_64.rpm
98f8b1bcae2ca325b95d84b03a8a21c3 mes5/x86_64/lib64png-devel-1.2.31-2.4mdvmes5.2.x86_64.rpm
8388f578116a05c96b2ef54120b0966a mes5/x86_64/lib64png-static-devel-1.2.31-2.4mdvmes5.2.x86_64.rpm
e92d9e5a9d2cec26614e0073bf8772a4 mes5/x86_64/libpng-source-1.2.31-2.4mdvmes5.2.x86_64.rpm
7716bbc53dbf07a4bcf647d19c872321 mes5/SRPMS/libpng-1.2.31-2.4mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFOnAexmqjQ0CJFipgRAiC/AJwIkOxF8xx1X/fqiVbBWSvwYvsUTgCghJK4
cuIrHQMral/wcOT4/A6Pl1I=
=24jp
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close