OpenPKG
18/11/06, 14:37
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
__________________________________________________ ______________________
OpenPKG Security Advisory OpenPKG GmbH
http://openpkg.org/security/ http://openpkg.com
OpenPKG-SA-2006.036 2006-11-17
__________________________________________________ ______________________
Package: png
Vulnerability: denial of service
OpenPKG Specific: no
Affected Series: Affected Packages: Corrected Packages:
E1.0-SOLID <= png-1.2.12-E1.0.0 >= png-1.2.12-E1.0.1
2-STABLE-20061018 <= png-1.2.12-2.20061018 >= png-1.2.13-2.20061116
2-STABLE <= png-1.2.12-2.20061018 >= png-1.2.13-2.20061116
CURRENT <= png-1.2.12-20061012 >= png-1.2.13-20061116
Description:
As confirmed by the vendor, a Denial of Service (DoS) vulnerability
exists in the PNG [0] image format library libpng [1], versions 1.0.6
through 1.2.12 and 1.0.20. The bug is in the decoder for the sPLT
("suggested palette") chunk and can lead to crashes and, accordingly,
a DoS, when an application using libpng for PNG processing displays a
specially crafted PNG image. The Common Vulnerabilities and Exposures
(CVE) project assigned the id CVE-2006-5793 [2] to the problem.
__________________________________________________ ______________________
References:
[0] http://www.libpng.org/pub/png/
[1] http://www.libpng.org/pub/png/libpng.html
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5793
__________________________________________________ ______________________
For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG <openpkg@openpkg.org>" (ID 63C4CB9F) which
you can retrieve from http://openpkg.org/openpkg.org.pgp. Follow the
instructions on http://openpkg.org/security/signatures/ for details on
how to verify the integrity of this advisory.
__________________________________________________ ______________________
-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG <openpkg@openpkg.org>
iD8DBQFFXXaWgHWT4GPEy58RAhKOAJwMnHAAuITUWPEiMFaGMi BK9DattACeKq+J
T9O+2CcdG0iwbDjXV1/Sl40=
=6FRk
-----END PGP SIGNATURE-----
Hash: SHA1
__________________________________________________ ______________________
OpenPKG Security Advisory OpenPKG GmbH
http://openpkg.org/security/ http://openpkg.com
OpenPKG-SA-2006.036 2006-11-17
__________________________________________________ ______________________
Package: png
Vulnerability: denial of service
OpenPKG Specific: no
Affected Series: Affected Packages: Corrected Packages:
E1.0-SOLID <= png-1.2.12-E1.0.0 >= png-1.2.12-E1.0.1
2-STABLE-20061018 <= png-1.2.12-2.20061018 >= png-1.2.13-2.20061116
2-STABLE <= png-1.2.12-2.20061018 >= png-1.2.13-2.20061116
CURRENT <= png-1.2.12-20061012 >= png-1.2.13-20061116
Description:
As confirmed by the vendor, a Denial of Service (DoS) vulnerability
exists in the PNG [0] image format library libpng [1], versions 1.0.6
through 1.2.12 and 1.0.20. The bug is in the decoder for the sPLT
("suggested palette") chunk and can lead to crashes and, accordingly,
a DoS, when an application using libpng for PNG processing displays a
specially crafted PNG image. The Common Vulnerabilities and Exposures
(CVE) project assigned the id CVE-2006-5793 [2] to the problem.
__________________________________________________ ______________________
References:
[0] http://www.libpng.org/pub/png/
[1] http://www.libpng.org/pub/png/libpng.html
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5793
__________________________________________________ ______________________
For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG <openpkg@openpkg.org>" (ID 63C4CB9F) which
you can retrieve from http://openpkg.org/openpkg.org.pgp. Follow the
instructions on http://openpkg.org/security/signatures/ for details on
how to verify the integrity of this advisory.
__________________________________________________ ______________________
-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG <openpkg@openpkg.org>
iD8DBQFFXXaWgHWT4GPEy58RAhKOAJwMnHAAuITUWPEiMFaGMi BK9DattACeKq+J
T9O+2CcdG0iwbDjXV1/Sl40=
=6FRk
-----END PGP SIGNATURE-----