===========================================================
Ubuntu Security Notice USN-913-1             March 16, 2010
libpng vulnerabilities
CVE-2009-2042, CVE-2010-0205
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  libpng12-0                      1.2.8rel-5ubuntu0.5

Ubuntu 8.04 LTS:
  libpng12-0                      1.2.15~beta5-3ubuntu0.2

Ubuntu 8.10:
  libpng12-0                      1.2.27-1ubuntu0.2

Ubuntu 9.04:
  libpng12-0                      1.2.27-2ubuntu2.1

Ubuntu 9.10:
  libpng12-0                      1.2.37-1ubuntu0.1

After a standard system upgrade you need to reboot your computer to effect
the necessary changes.

Details follow:

It was discovered that libpng did not properly initialize memory when
decoding certain 1-bit interlaced images. If a user or automated system
were tricked into processing crafted PNG images, an attacker could possibly
use this flaw to read sensitive information stored in memory. This issue
only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04. (CVE-2009-2042)

It was discovered that libpng did not properly handle certain excessively
compressed PNG images. If a user or automated system were tricked into
processing a crafted PNG image, an attacker could possibly use this flaw to
consume all available resources, resulting in a denial of service.
(CVE-2010-0205)


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel-5ubuntu0.5.diff.gz
      Size/MD5:    22337 fa254fcc4cb513e59eb9467abad87cca
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel-5ubuntu0.5.dsc
      Size/MD5:      661 17f3956e31ccadfed0a3bfdc8f5f065a
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.8rel.orig.tar.gz
      Size/MD5:   510681 cac1512878fb98f2456df6dc50bc9bc7

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.8rel-5ubuntu0.5_all.deb
      Size/MD5:      842 a5ab55fb1b372c9ac93493fd699b276f

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_amd64.deb
      Size/MD5:   114374 1315864425b2dfaea123fe05118de0b0
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_amd64.deb
      Size/MD5:   247552 4acf10d5d173d06843cb1dc9b1b894fe
    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_amd64.udeb
      Size/MD5:    69464 1761fb1c524387b8aabd7bd3dccb2eda

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_i386.deb
      Size/MD5:   111916 0043501424d2cee81d5f6229a2b3d166
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_i386.deb
      Size/MD5:   239610 8422b7b137f09b49d27541a87251cce4
    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_i386.udeb
      Size/MD5:    66948 a8e6db358ed472eb9f18d3b51aed1347

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_powerpc.deb
      Size/MD5:   111422 a0ea39141ce6319b057db22e9fcaf8d6
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_powerpc.deb
      Size/MD5:   245142 d2d7ed0b8fa777fd58fe78345625a1e7
    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_powerpc.udeb
      Size/MD5:    66386 f65de398bac540da7a25370999eb9643

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.8rel-5ubuntu0.5_sparc.deb
      Size/MD5:   108988 5bad496a668c87614866fe1f04c8c17e
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.8rel-5ubuntu0.5_sparc.deb
      Size/MD5:   239972 b3cf4fc712ab063ababdefc5030ad07a
    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.8rel-5ubuntu0.5_sparc.udeb
      Size/MD5:    63832 148d28886ec7fdb3334196a762daad1c

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5-3ubuntu0.2.diff.gz
      Size/MD5:    21048 9f9e2ce175afd0a41bfa613c8672a164
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5-3ubuntu0.2.dsc
      Size/MD5:      832 59b9f6994e1bef9b8f83561b70afda00
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.15~beta5.orig.tar.gz
      Size/MD5:   829038 77ca14fcee1f1f4daaaa28123bd0b22d

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.15~beta5-3ubuntu0.2_all.deb
      Size/MD5:      940 e6cfd9d151530dac9ef81148e1690e61

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_amd64.deb
      Size/MD5:   190022 6a7c0dfd7c8501f8628178b5b0eee0cd
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_amd64.deb
      Size/MD5:   179662 bc60e9256f650d385f0c1d175c14fe80
    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_amd64.udeb
      Size/MD5:    70430 a6782df5314e3c49137b1d3253c2c6b4

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_i386.deb
      Size/MD5:   188650 0d4b87ea55d252a24bc74ebc4d748645
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_i386.deb
      Size/MD5:   171178 9608ecb2bd7697bbf4510822a6c61e32
    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_i386.udeb
      Size/MD5:    69094 f39b5e822f4da67599876c68904ecad1

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_lpia.deb
      Size/MD5:   189520 36f70d5b5d6cc10e89323efd72b3e061
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_lpia.deb
      Size/MD5:   172882 1b5a5a4d6198c0eb6b14dc89c5a9da19
    http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_lpia.udeb
      Size/MD5:    69994 a3e824e57de27f7b7ed1b93ddd6f6917

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_powerpc.deb
      Size/MD5:   190076 8ec2399126dc45cb9069588dec4f23ef
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_powerpc.deb
      Size/MD5:   179070 3a16935d6ed3029b636f5a2277470659
    http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_powerpc.udeb
      Size/MD5:    70556 a2f68773735f91ca14c95fe374a56d7b

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.15~beta5-3ubuntu0.2_sparc.deb
      Size/MD5:   185426 8755e9f8c1be78dbe2de213d9666fd7f
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.15~beta5-3ubuntu0.2_sparc.deb
      Size/MD5:   173332 f94ff6354e27bda2f21a8a542e77f274
    http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.15~beta5-3ubuntu0.2_sparc.udeb
      Size/MD5:    65854 2631780a00ee2727264e6d0f477daa83

Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-1ubuntu0.2.diff.gz
      Size/MD5:    19116 22de419d4a9203e183ccc14813b0d5e2
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-1ubuntu0.2.dsc
      Size/MD5:     1293 bd0ff3a04141fae88c8136f6f9ee63d4
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27.orig.tar.gz
      Size/MD5:   783204 13a0de401db1972a8e68f47d5bdadd13

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.27-1ubuntu0.2_all.deb
      Size/MD5:      934 cdd02e7c09b4bb61bd14670f155f81f4

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_amd64.deb
      Size/MD5:   168308 37a5c4970ffd3dc878026e66310bfecc
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_amd64.deb
      Size/MD5:   255526 df3e911f99e2d64d3246710e0dea9d49
    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_amd64.udeb
      Size/MD5:    72758 6a64efb6a07e32ddfe80bed566e110c8

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_i386.deb
      Size/MD5:   166630 08a7389cb42e41ebba773ecdb9e347fe
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_i386.deb
      Size/MD5:   247664 e39fbb64952529e977b335e308662782
    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_i386.udeb
      Size/MD5:    71014 9e5c717ed5d4e17d86caabb80221030d

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_lpia.deb
      Size/MD5:   167096 ed195852cc2b60cb0ddc9cccf87ed280
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_lpia.deb
      Size/MD5:   248616 dc85b020b9a129916f24618d3e27e684
    http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_lpia.udeb
      Size/MD5:    71418 e60289ac791f78aae8eb5598a3eacb5a

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_powerpc.deb
      Size/MD5:   167230 5f8b71b3a98b1645727f1f4ae534f960
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_powerpc.deb
      Size/MD5:   254380 76ea57650fd01eb86a315ca0b73dcdca
    http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_powerpc.udeb
      Size/MD5:    71582 f9b8803343f2f61bf5f07b1fb4a25918

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-1ubuntu0.2_sparc.deb
      Size/MD5:   162222 445a3d3abb843e73fbf89fe0520ab664
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-1ubuntu0.2_sparc.deb
      Size/MD5:   248216 768f20b123d1b0c1c448b3b240245d5c
    http://ports.ubuntu.com/pool/universe/libp/libpng/libpng12-0-udeb_1.2.27-1ubuntu0.2_sparc.udeb
      Size/MD5:    66728 cf376eab6461fdee69f0bbde6d58dc53

Updated packages for Ubuntu 9.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-2ubuntu2.1.diff.gz
      Size/MD5:   174503 ffa63cd1b57dc442faff9a65d2f25ee7
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27-2ubuntu2.1.dsc
      Size/MD5:     1296 890ff19ff7b12aa90d0d38c0b1550055
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.27.orig.tar.gz
      Size/MD5:   783204 13a0de401db1972a8e68f47d5bdadd13

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.27-2ubuntu2.1_all.deb
      Size/MD5:      936 3dee09961304f1caf76db0995a027b95

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_amd64.udeb
      Size/MD5:    72778 30622682dc700cba1101384ab84fe7ca
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_amd64.deb
      Size/MD5:   168382 4be6ce864bf04169baf7d4b656ea8e02
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_amd64.deb
      Size/MD5:   255620 730ed6a69006fa14753ef99f89664d31

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_i386.udeb
      Size/MD5:    71084 5a3cc8f7589fae49e91689d85476b193
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_i386.deb
      Size/MD5:   166732 d674a5262197c091d9ca5b2370cff187
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_i386.deb
      Size/MD5:   247744 644a3757529a46d3389e2db18a566f3d

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_lpia.udeb
      Size/MD5:    71472 662aba7284b732240c2d7bff864eed12
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_lpia.deb
      Size/MD5:   167200 47dc03f91b37b73626e026cb7da28b15
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_lpia.deb
      Size/MD5:   248706 a01e8fe54d38f4101c6ad0f78eec4a7e

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_powerpc.udeb
      Size/MD5:    71564 96e3fb7342ab462db7a27fbd39a46649
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_powerpc.deb
      Size/MD5:   167254 90e1cb3da8cc85953442611cf0faaed8
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_powerpc.deb
      Size/MD5:   254444 4b89c89e031c0d4265b1eb3da45f06e9

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.27-2ubuntu2.1_sparc.udeb
      Size/MD5:    66646 ac9aa1a738ef8ed71bd8b876f1920098
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.27-2ubuntu2.1_sparc.deb
      Size/MD5:   162176 06a1b4ab47a39790da4e9b1e0967c1d2
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.27-2ubuntu2.1_sparc.deb
      Size/MD5:   248222 91cca4c40c4ce6ac41df52ea62e5008a

Updated packages for Ubuntu 9.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37-1ubuntu0.1.diff.gz
      Size/MD5:    18107 a9bf93cac21b17a3589193ae511b75d2
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37-1ubuntu0.1.dsc
      Size/MD5:     1293 dc9a20f9a129ad150f61ec9bb745b039
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng_1.2.37.orig.tar.gz
      Size/MD5:   805380 7480dbbf9f6c3297faf6fe52ec9b91ab

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/libp/libpng/libpng3_1.2.37-1ubuntu0.1_all.deb
      Size/MD5:      934 3d21bd9bf41fe210303474389cfeb0a8

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_amd64.udeb
      Size/MD5:    73848 d436fc20150573d565017d9e29141484
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_amd64.deb
      Size/MD5:   174886 34607a76ee1ebdd82b5c71068e6e32b2
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_amd64.deb
      Size/MD5:   265214 f600588bdf4f00731d94ccd8bbc68455

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_i386.udeb
      Size/MD5:    70382 7d93414ce0e28351b972605abae92cd1
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_i386.deb
      Size/MD5:   171402 2b8f6f1c8e8300c3149c59d1fc107659
    http://security.ubuntu.com/ubuntu/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_i386.deb
      Size/MD5:   255250 a033009f8d9a990655437c3d129668bf

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_lpia.udeb
      Size/MD5:    71012 d3df3a73bf61acb9f1d489a32b3b8a60
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_lpia.deb
      Size/MD5:   172126 1b94fcc470ba8878eace85240fae74cf
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_lpia.deb
      Size/MD5:   257172 3c3280435a2b7d1817b49cd4a3a14bef

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_powerpc.udeb
      Size/MD5:    72402 e0b80daed7db7e00d2a921ed5708ffe8
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_powerpc.deb
      Size/MD5:   173494 31c424c02fe594bb6cf9acd1bef1763f
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_powerpc.deb
      Size/MD5:   264450 b0546250e1804b0d385bb8eb714cd2da

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0-udeb_1.2.37-1ubuntu0.1_sparc.udeb
      Size/MD5:    67312 0df0d665eeb40343b9d5485910101786
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-0_1.2.37-1ubuntu0.1_sparc.deb
      Size/MD5:   168372 2a079837d6b9f47c41a02340c5d9e27c
    http://ports.ubuntu.com/pool/main/libp/libpng/libpng12-dev_1.2.37-1ubuntu0.1_sparc.deb
      Size/MD5:   257434 05811c8ff658321e91078f280dacfbe7