libpng, libpng10 security update

CentOS Errata and Security Advisory CESA-2007:0356

The libpng package contains a library of functions for creating and
manipulating PNG (Portable Network Graphics) image format files.

A flaw was found in the handling of malformed images in libpng. An attacker
could create a carefully crafted PNG image file in such a way that it could
cause an application linked with libpng to crash when the file was
manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker
could create a carefully crafted PNG image file in such a way that it could
cause an application linked with libpng to crash when the file was opened.
(CVE-2006-5793)

Users of libpng should update to these updated packages which contain
backported patches to correct these issues.

Red Hat would like to thank Glenn Randers-Pehrson, Mats Palmgren, and Tavis
Ormandy for supplying details and patches for these issues.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2007-May/075942.html
https://lists.centos.org/pipermail/centos-announce/2007-May/075943.html
https://lists.centos.org/pipermail/centos-announce/2007-May/075952.html
https://lists.centos.org/pipermail/centos-announce/2007-May/075953.html
https://lists.centos.org/pipermail/centos-announce/2007-May/075960.html
https://lists.centos.org/pipermail/centos-announce/2007-May/075961.html
https://lists.centos.org/pipermail/centos-announce/2007-May/075962.html
https://lists.centos.org/pipermail/centos-announce/2007-May/075963.html

Affected packages:
libpng
libpng-devel
libpng10
libpng10-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0356