Multiple vulnerabilities have been discovered in libpng, the worst of which could lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.6.51 | >= 1.6.51 |
libpng is the official PNG reference library used to read, write and manipulate PNG images.
Multiple vulnerabilities have been discovered in libpng. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.6.51"
Multiple vulnerabilities have been found in libpng, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.6.37:0 | >= 1.6.37:0 |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several programs, including web browsers and potentially server processes.
Multiple vulnerabilities have been discovered in libpng. Please review the CVE identifiers referenced below for details.
A remote attacker, by enticing a user to process a specially crafted PNG file, could cause a Denial of Service condition.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.6.37"
A null pointer dereference in libpng might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.6.27 | >= 1.6.27, >= 1.5.28:1.5, >= 1.2.57:1.2 |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several programs, including web browsers and potentially server processes.
A null pointer dereference was discovered in libpng in the png_push_save_buffer function. In order to be vulnerable, an application has to load a text chunk into the PNG structure, then delete all text, then add another text chunk to the same PNG structure, which seems to be an unlikely sequence, but it is possible.
A remote attacker, by enticing a user to process a specially crafted PNG file, could execute arbitrary code with the privileges of the process.
There is no known workaround at this time.
All libpng 1.6.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.6.27"
All libpng 1.5.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.5.28:1.5"
All libpng 1.2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.57:1.2"
Multiple vulnerabilities have been found in libpng, the worst of which may allow remote attackers to cause Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.6.21 | >= 1.2.56:1.2, >= 1.5.26:1.5, >= 1.6.21 |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several other programs, including web browsers and potentially server processes.
Multiple vulnerabilities were found in libpng. Please review the referenced CVE’s for additional information.
Remote attackers could cause a Denial of Service condition or have other unspecified impacts.
There is no known workaround at this time.
All libpng 1.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.56"
All libpng 1.5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.5.26"
All libpng 1.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.6.21"
Two vulnerabilities have been found in libpng, possibly resulting in execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.6.16 | >= 1.6.16, >= 1.5.21:1.5, >= 1.2.52:1.2 |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several programs, including web browsers and potentially server processes.
Two vulnerabilities have been discovered in libpng:
A context-dependent attacker could entice a user to open a specially crafted PNG file using an application linked against libpng, possibly resulting in execution of arbitrary code.
There is no known workaround at this time.
All libpng 1.6 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.6.16"
All libpng 1.5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.5.21"
Multiple vulnerabilities have been discovered in libpng which can allow a remote attacker to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.6.10 | >= 1.6.10, < 1.3, >= 1.5.18 (revision), >= 1.5.19 (revision), >= 1.5.20 (revision), >= 1.5.21 (revision), >= 1.5.22 (revision), >= 1.5.23 (revision), >= 1.5.24 (revision), >= 1.5.25 (revision) |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several programs, including web browsers and potentially server processes.
The png_push_read_chunk function in pngpread.c in the progressive decoder enters an infinite loop, when it encounters a zero-length IDAT chunk. In addition certain integer overflows have been detected and corrected.
The 1.2 branch is not affected by these vulnerabilities.
A remote attacker could entice a user to open a specially crafted PNG file using an application linked against libpng, possibly resulting in Denial of Service.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.6.10"
Users with current installs in the 1.5 branch should also upgrade this using:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.5.18:1.5"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.
Multiple vulnerabilities in libpng might allow remote attackers to execute arbitrary code or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.5.10 | >= 1.5.10, >= 1.2.49:1.2 |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several programs, including web browsers and potentially server processes.
Multiple vulnerabilities have been discovered in libpng:
An attacker could exploit these vulnerabilities to execute arbitrary code with the permissions of the user running the vulnerable program, which could be the root user, or to cause programs linked against the library to crash.
There is no known workaround at this time.
All libpng 1.5 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.5.10"
All libpng 1.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.49"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
Multiple vulnerabilities in libpng might lead to privilege escalation or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.4.3 | >= 1.4.3, >= 1.2.46:1.2 |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several programs, including web browsers and potentially server processes.
Multiple vulnerabilities were found in libpng:
An attacker could exploit these vulnerabilities to cause programs linked against the library to crash or execute arbitrary code with the permissions of the user running the vulnerable program, which could be the root user.
There is no known workaround at this time.
All libpng 1.4 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.4.3"
All libpng 1.2 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.46"
A vulnerability has been discovered in libpng that allows for information disclosure.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.2.37 | >= 1.2.37 |
libpng is the official PNG reference library used to read, write and manipulate PNG images.
Jeff Phillips discovered that libpng does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file.
A remote attacker might entice a user to open a specially crafted PNG file, possibly resulting in the disclosure of sensitive memory portions.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.37"
Multiple vulnerabilities were found in libpng, which might result in the execution of arbitrary code
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.2.35 | >= 1.2.35 |
libpng is the official PNG reference library used to read, write and manipulate PNG images.
Multiple vulnerabilities were discovered in libpng:
A remote attacker may execute arbitrary code with the privileges of the user opening a specially crafted PNG file by exploiting the erroneous out-of-memory handling. An attacker may also exploit the png_check_keyword() error to set arbitrary memory locations to 0, if the application allows overlong, user-controlled keywords when writing PNG files. The png_handle_tEXT() vulnerability may be exploited by an attacker to potentially consume all memory on a users system when a specially crafted PNG file is opened.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.35"
A vulnerability in libpng may allow for execution of arbitrary code in certain applications that handle untrusted images.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.2.26-r1 | >= 1.2.26-r1 |
libpng is a free ANSI C library used to process and manipulate PNG images.
Tavis Ormandy of the Google Security Team discovered that libpng does not handle zero-length unknown chunks in PNG files correctly, which might lead to memory corruption in applications that call png_set_read_user_chunk_fn() or png_set_keep_unknown_chunks().
A remote attacker could entice a user or automated system to process a specially crafted PNG image in an application using libpng and possibly execute arbitrary code with the privileges of the user running the application. Note that processing of unknown chunks is disabled by default in most PNG applications, but some such as ImageMagick are affected.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.26-r1"
Several vulnerabilities in libpng may allow a remote attacker to crash applications that handle untrusted images.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.2.21-r3 | >= 1.2.21-r3 |
libpng is a free ANSI C library used to process and manipulate PNG images.
An off-by-one error when handling ICC profile chunks in the png_set_iCCP() function was discovered (CVE-2007-5266). George Cook and Jeff Phillips reported several errors in pngrtran.c, the use of logical instead of a bitwise functions and incorrect comparisons (CVE-2007-5268). Tavis Ormandy reported out-of-bounds read errors in several PNG chunk handling functions (CVE-2007-5269).
A remote attacker could craft an image that when processed or viewed by an application using libpng would cause the application to terminate abnormally.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.21-r3"
A vulnerability in libpng may allow a remote attacker to crash applications that handle untrusted images.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.2.17 | >= 1.2.17 |
libpng is a free ANSI C library used to process and manipulate PNG images.
Mats Palmgren fixed an error in file pngrutil.c in which the trans[] array might be not allocated because of images with a bad tRNS chunk CRC value.
A remote attacker could craft an image that when processed or viewed by an application using libpng causes the application to terminate abnormally.
There is no known workaround at this time.
Please note that due to separate bugs in libpng 1.2.17, Gentoo does not provide libpng-1.2.17 but libpng-1.2.18. All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.18"
A vulnerability in libpng may allow a remote attacker to crash applications that handle untrusted images.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | < 1.2.13 | >= 1.2.13 |
libpng is a free ANSI C library used to process and manipulate PNG images.
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that a vulnerability exists in the sPLT chunk handling code of libpng, a large sPLT chunk may cause an application to attempt to read out of bounds.
A remote attacker could craft an image that when processed or viewed by an application using libpng causes the application to terminate abnormally.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.13"
A buffer overflow has been found in the libpng library that could lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/emul-linux-x86-baselibs | amd64 | < 2.5.1 | >= 2.5.1 |
| media-libs/libpng | * | < 1.2.12 | >= 1.2.12 |
libpng is an open, extensible image format library, with lossless compression.
In pngrutil.c, the function png_decompress_chunk() allocates insufficient space for an error message, potentially overwriting stack data, leading to a buffer overflow.
By enticing a user to load a maliciously crafted PNG image, an attacker could execute arbitrary code with the rights of the user, or crash the application using the libpng library, such as the emul-linux-x86-baselibs.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.12"
All AMD64 emul-linux-x86-baselibs users should also upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/emul-linux-x86-baselibs-2.5.1"
libpng contains numerous vulnerabilities potentially allowing an attacker to perform a Denial of Service attack or even execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | <= 1.2.5-r7 | >= 1.2.5-r8 |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several other programs, including web browsers and potentially server processes.
libpng contains numerous vulnerabilities including null pointer dereference errors and boundary errors in various functions.
An attacker could exploit these vulnerabilities to cause programs linked against the library to crash or execute arbitrary code with the permissions of the user running the vulnerable program, which could be the root user.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version.
All libpng users should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=media-libs/libpng-1.2.5-r8" # emerge ">=media-libs/libpng-1.2.5-r8"
You should also run revdep-rebuild to rebuild any packages that depend on older versions of libpng :
# revdep-rebuild
libpng contains a buffer overflow vulnerability potentially allowing an attacker to perform a Denial of Service attack or even execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | <= 1.2.5-r6 | >= 1.2.5-r7 |
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several other programs, including web browsers and potentially server processes.
Due to a wrong calculation of loop offset values, libpng contains a buffer overflow vulnerability on the row buffers. This vulnerability was initially patched in January 2003 but since it has been discovered that libpng contains the same vulnerability in two other places.
An attacker could exploit this vulnerability to cause programs linked against the library to crash or execute arbitrary code with the permissions of the user running the vulnerable program, which could be the root user.
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version.
All libpng users should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=media-libs/libpng-1.2.5-r7" # emerge ">=media-libs/libpng-1.2.5-r7"
You should also run revdep-rebuild to rebuild any packages that depend on older versions of libpng :
# revdep-rebuild
A bug in the libpng library can be abused to crash programs making use of that library to decode PNG images.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libpng | * | <= 1.2.5-r4 | >= 1.2.5-r5 |
libpng is a standard library used to process PNG (Portable Network Graphics) images.
libpng provides two functions (png_chunk_error and png_chunk_warning) for default error and warning messages handling. These functions do not perform proper bounds checking on the provided message, which is limited to 64 bytes. Programs linked against this library may crash when handling a malicious PNG image.
This vulnerability could be used to crash various programs using the libpng library, potentially resulting in a denial of service attack on vulnerable daemon processes.
There is no known workaround at this time. All users are advised to upgrade to the latest available version of libpng.
All users of libpng should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=media-libs/libpng-1.2.5-r5" # emerge ">=media-libs/libpng-1.2.5-r5"
You should also run revdep-rebuild to rebuild any packages that depend on older versions of libpng :
# revdep-rebuild