(RHSA-2007:0356) Moderate: libpng security update

2007-05-17T04:00:00
ID RHSA-2007:0356
Type redhat
Reporter RedHat
Modified 2019-03-22T23:43:04

Description

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A flaw was found in the handling of malformed images in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was opened. (CVE-2006-5793)

Users of libpng should update to these updated packages which contain backported patches to correct these issues.

Red Hat would like to thank Glenn Randers-Pehrson, Mats Palmgren, and Tavis Ormandy for supplying details and patches for these issues.