Articles / Ubuntu: New libpng packages…

Ubuntu: New libpng packages fix security vulnerabilities

Frank Busse discovered that libpng did not properly handle certain malformed PNG images. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause libpng to crash, resulting in a denial of service. It was discovered that libpng did not properly handle certain malformed PNG images. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. Frank Busse discovered that libpng did not properly handle certain PNG images with invalid sCAL chunks. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. Updated packages are available from security.ubuntu.com.

==========================================================================
Ubuntu Security Notice USN-1175-1
July 26, 2011

libpng vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS

Summary:

Libpng could be made to run programs as your login if it opened a
specially crafted file.

Software Description:
- libpng: PNG (Portable Network Graphics) file library

Details:

Frank Busse discovered that libpng did not properly handle certain
malformed PNG images. If a user or automated system were tricked into
opening a crafted PNG file, an attacker could cause libpng to crash,
resulting in a denial of service. This issue only affected Ubuntu
10.04 LTS, 10.10, and 11.04. (CVE-2011-2501)

It was discovered that libpng did not properly handle certain malformed PNG
images. If a user or automated system were tricked into opening a crafted
PNG file, an attacker could cause a denial of service or possibly execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2011-2690)

Frank Busse discovered that libpng did not properly handle certain PNG
images with invalid sCAL chunks. If a user or automated system were tricked
into opening a crafted PNG file, an attacker could cause a denial of
service or possibly execute arbitrary code with the privileges of the user
invoking the program. (CVE-2011-2692)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
 libpng12-0                      1.2.44-1ubuntu3.1

Ubuntu 10.10:
 libpng12-0                      1.2.44-1ubuntu0.1

Ubuntu 10.04 LTS:
 libpng12-0                      1.2.42-1ubuntu2.2

Ubuntu 8.04 LTS:
 libpng12-0                      1.2.15~beta5-3ubuntu0.4

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
 http://www.ubuntu.com/usn/usn-1175-1
 CVE-2011-2501, CVE-2011-2690, CVE-2011-2692

Package Information:
 https://launchpad.net/ubuntu/+source/libpng/1.2.44-1ubuntu3.1
 https://launchpad.net/ubuntu/+source/libpng/1.2.44-1ubuntu0.1
 https://launchpad.net/ubuntu/+source/libpng/1.2.42-1ubuntu2.2
 https://launchpad.net/ubuntu/+source/libpng/1.2.15~beta5-3ubuntu0.4
Screenshot

Project Spotlight

Kigo Video Converter Ultimate for Mac

A tool for converting and editing videos.

Screenshot

Project Spotlight

Kid3

An efficient tagger for MP3, Ogg/Vorbis, and FLAC files.