Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A flaw was found in the handling of malformed images in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was opened. (CVE-2006-5793)

Users of libpng should update to these updated packages which contain backported patches to correct these issues.

Red Hat would like to thank Glenn Randers-Pehrson, Mats Palmgren, and Tavis Ormandy for supplying details and patches for these issues.

The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.

This update to libpng 1.0.26 resolves this problem.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
25256	CentOS 3 / 4 / 5 : libpng (CESA-2007:0356)	Nessus	CentOS Local Security Checks	2007/5/20	2021/1/4	medium
62266	Fedora 7 : libpng10-1.0.26-1.fc7.1 (2007-0004)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	medium
25269	RHEL 2.1 / 3 / 4 / 5 : libpng (RHSA-2007:0356)	Nessus	Red Hat Local Security Checks	2007/5/20	2021/1/14	medium
107483	Solaris 10 (sparc) : 137080-07	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/24	high
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	2014/12/15	2022/5/5	critical

检测

插件搜索

medium

medium

medium

high

critical