[gentoo-commits] gentoo commit in xml/htdocs/security/en/glsa: glsa-201010-01.xml

[Pierre-Yves Rofes (py)]

py          10/10/05 21:26:12

  Added:                glsa-201010-01.xml
  Log:
  GLSA 201010-01

Revision  Changes    Path
1.1                  xml/htdocs/security/en/glsa/glsa-201010-01.xml

file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/security/en/glsa/glsa-201010-01.xml?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/security/en/glsa/glsa-201010-01.xml?rev=1.1&content-type=text/plain

Index: glsa-201010-01.xml
===================================================================
<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">

<glsa id="201010-01">
  <title>Libpng: Multiple vulnerabilities</title>
  <synopsis>
    Multiple vulnerabilities in libpng might lead to privilege escalation or a
    Denial of Service.
  </synopsis>
  <product type="ebuild">libpng</product>
  <announced>October 05, 2010</announced>
  <revised>October 05, 2010: 01</revised>
  <bug>307637</bug>
  <bug>324153</bug>
  <bug>335887</bug>
  <access>remote</access>
  <affected>
    <package name="media-libs/libpng" auto="yes" arch="*">
      <unaffected range="ge">1.4.3</unaffected>
      <vulnerable range="lt">1.4.3</vulnerable>
    </package>
  </affected>
  <background>
    <p>
    libpng is a standard library used to process PNG (Portable Network
    Graphics) images. It is used by several programs, including web
    browsers and potentially server processes.
    </p>
  </background>
  <description>
    <p>
    Multiple vulnerabilities were found in libpng:
    </p>
    <ul><li>The
    png_decompress_chunk() function in pngrutil.c does not properly handle
    certain type of compressed data (CVE-2010-0205)</li>
    <li>A buffer
    overflow in pngread.c when using progressive applications
    (CVE-2010-1205)</li>
    <li>A memory leak in pngrutil.c when dealing with
    a certain type of chunks (CVE-2010-2249)</li>
    </ul>
  </description>
  <impact type="normal">
    <p>
    An attacker could exploit these vulnerabilities to cause programs
    linked against the library to crash or execute arbitrary code with the
    permissions of the user running the vulnerable program, which could be
    the root user.
    </p>
  </impact>
  <workaround>
    <p>
    There is no known workaround at this time.
    </p>
  </workaround>
  <resolution>
    <p>
    All libpng users should upgrade to the latest version:
    </p>
    <code>
    # emerge --sync
    # emerge --ask --oneshot --verbose &quot;&gt;=media-libs/libpng-1.4.3&quot;</code>
  </resolution>
  <references>
    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0205">CVE-2010-0205</uri>
    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205">CVE-2010-1205</uri>
    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2249">CVE-2010-2249</uri>
  </references>
  <metadata tag="requester" timestamp="Sun, 01 Aug 2010 12:51:01 +0000">
    craig
  </metadata>
  <metadata tag="submitter" timestamp="Tue, 28 Sep 2010 18:37:13 +0000">
    p-y
  </metadata>
  <metadata tag="bugReady" timestamp="Tue, 28 Sep 2010 18:37:43 +0000">
    p-y
  </metadata>
</glsa>