- Vulnerability/
- RHSA-2010:0534
RHSA-2010:0534: Important: libpng security update
First published: Wed Jul 14 2010(Updated: )
The libpng packages contain a library of functions for creating and<br>manipulating PNG (Portable Network Graphics) image format files.<br>A memory corruption flaw was found in the way applications, using the<br>libpng library and its progressive reading method, decoded certain PNG<br>images. An attacker could create a specially-crafted PNG image that, when<br>opened, could cause an application using libpng to crash or, potentially,<br>execute arbitrary code with the privileges of the user running the<br>application. (CVE-2010-1205)<br>A denial of service flaw was found in the way applications using the libpng<br>library decoded PNG images that have certain, highly compressed ancillary<br>chunks. An attacker could create a specially-crafted PNG image that could<br>cause an application using libpng to consume excessive amounts of memory<br>and CPU time, and possibly crash. (CVE-2010-0205)<br>A memory leak flaw was found in the way applications using the libpng<br>library decoded PNG images that use the Physical Scale (sCAL) extension. An<br>attacker could create a specially-crafted PNG image that could cause an<br>application using libpng to exhaust all available memory and possibly crash<br>or exit. (CVE-2010-2249)<br>A sensitive information disclosure flaw was found in the way applications<br>using the libpng library processed 1-bit interlaced PNG images. An attacker<br>could create a specially-crafted PNG image that could cause an application<br>using libpng to disclose uninitialized memory. (CVE-2009-2042)<br>Users of libpng and libpng10 should upgrade to these updated packages,<br>which contain backported patches to correct these issues. All running<br>applications using libpng or libpng10 must be restarted for the update to<br>take effect.<br>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/libpng | <1.2.10-7.1.el5_5.3 | 1.2.10-7.1.el5_5.3 |
| redhat/libpng | <1.2.10-7.1.el5_5.3 | 1.2.10-7.1.el5_5.3 |
| redhat/libpng-devel | <1.2.10-7.1.el5_5.3 | 1.2.10-7.1.el5_5.3 |
| redhat/libpng-devel | <1.2.10-7.1.el5_5.3 | 1.2.10-7.1.el5_5.3 |
| redhat/libpng | <1.2.7-3.el4_8.3 | 1.2.7-3.el4_8.3 |
| redhat/libpng10 | <1.0.16-3.el4_8.4 | 1.0.16-3.el4_8.4 |
| redhat/libpng | <1.2.7-3.el4_8.3 | 1.2.7-3.el4_8.3 |
| redhat/libpng-devel | <1.2.7-3.el4_8.3 | 1.2.7-3.el4_8.3 |
| redhat/libpng10 | <1.0.16-3.el4_8.4 | 1.0.16-3.el4_8.4 |
| redhat/libpng10-devel | <1.0.16-3.el4_8.4 | 1.0.16-3.el4_8.4 |
| redhat/libpng-devel | <1.2.7-3.el4_8.3 | 1.2.7-3.el4_8.3 |
| redhat/libpng10-devel | <1.0.16-3.el4_8.4 | 1.0.16-3.el4_8.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=504782
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=566234
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=608238
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=608644
- http://www.redhat.com/security/updates/classification/#important
- https://access.redhat.com/errata/RHSA-2010:0534 (Advisory)
Frequently Asked Questions
What is the severity of RHSA-2010:0534?
The severity of RHSA-2010:0534 is critical due to the potential for memory corruption exploits.
How do I fix RHSA-2010:0534?
To fix RHSA-2010:0534, upgrade the libpng and libpng-devel packages to version 1.2.10-7.1.el5_5.3 or later.
Which versions of libpng are affected by RHSA-2010:0534?
Versions of libpng earlier than 1.2.10-7.1.el5_5.3 are affected by RHSA-2010:0534.
What types of software are impacted by RHSA-2010:0534?
RHSA-2010:0534 impacts applications using the libpng library for decoding PNG images.
Is RHSA-2010:0534 related to any other vulnerabilities?
Yes, RHSA-2010:0534 is associated with memory corruption vulnerabilities that could be exploited in various applications.
- agent/severity
- agent/references
- agent/type
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2010:0534
- agent/software-canonical-lookup
- agent/remedy
- agent/title
- agent/description
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/redhat