RHSA-2011:1104: Moderate: libpng security update
The libpng packages contain a library of functions for creating andmanipulating PNG (Portable Network Graphics) image format files.A buffer overflow flaw was found in the way libpng processed certain PNGimage files. An attacker could create a specially-crafted PNG image that,when opened, could cause an application using libpng to crash or,potentially, execute arbitrary code with the privileges of the user runningthe application. (CVE-2011-2690)Note: The application behavior required to exploit CVE-2011-2690 is rarelyused. No application shipped with Red Hat Enterprise Linux behaves thisway, for example.An uninitialized memory read issue was found in the way libpng processedcertain PNG images that use the Physical Scale (sCAL) extension. Anattacker could create a specially-crafted PNG image that, when opened,could cause an application using libpng to crash. (CVE-2011-2692)Users of libpng should upgrade to these updated packages, which containbackported patches to correct these issues. All running applications usinglibpng must be restarted for the update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:1104?
The severity of RHSA-2011:1104 is classified as moderate.
How do I fix RHSA-2011:1104?
To fix RHSA-2011:1104, you should update the libpng and libpng-devel packages to version 1.2.10-7.1.el5_7.5.
What can happen if RHSA-2011:1104 is exploited?
If RHSA-2011:1104 is exploited, an attacker could potentially execute arbitrary code via a specially-crafted PNG image.
Which versions of libpng are affected by RHSA-2011:1104?
RHSA-2011:1104 affects all versions of libpng prior to 1.2.10-7.1.el5_7.5.
Is a system restart required after applying the RHSA-2011:1104 patch?
No, a system restart is not required after applying the patch for RHSA-2011:1104.