MGASA-2014-0210

Dashboard / Vulnerabilities / MGASA-2014-0210

MGASA-2014-0210

Summary: Updated libpng packages fix two security vulnerabilities

Details: Updated libpng12 and libpng packages fix security vulnerabilities: An integer overflow leading to a heap-based buffer overflow was found in the png_set_sPLT() and png_set_text_2() API functions of libpng. An attacker could create a specially-crafted image file and render it with an application written to explicitly call png_set_sPLT() or png_set_text_2() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application (CVE-2013-7353). An integer overflow leading to a heap-based buffer overflow was found in the png_set_unknown_chunks() API function of libpng. An attacker could create a specially-crafted image file and render it with an application written to explicitly call png_set_unknown_chunks() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application (CVE-2013-7354).

References: https://advisories.mageia.org/MGASA-2014-0210.html, http://lists.opensuse.org/opensuse-updates/2014-05/msg00026.html, http://lists.opensuse.org/opensuse-updates/2014-05/msg00024.html, https://bugs.mageia.org/show_bug.cgi?id=13185