Red Hat Security Advisory

Synopsis:          Updated libpng packages fix crash
Advisory ID:       RHSA-2004:180-01
Issue date:        2004-05-19
Updated on:        2004-05-19
Product:           Red Hat Enterprise Linux
Keywords:          
Cross references:  
Obsoletes:         
CVE Names:         CAN-2004-0421
- ---------------------------------------------------------------------

1. Topic:

Updated libpng packages that fix a out of bounds memory access are now
available.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, ppc64, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

The libpng package contains a library of functions for creating and
manipulating PNG (Portable Network Graphics) image format files.  

Steve Grubb discovered a out of bounds memory access flaw in libpng.  An
attacker could carefully craft a PNG file in such a way that it would cause
an application linked to libpng to crash when opened by a victim.  This
issue may not be used to execute arbitrary code.  

Users are advised to upgrade to these updated packages that contain a
backported security fix not vulnerable to this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL
Certificate Errors, you need to install a version of the
up2date client with an updated certificate.  The latest version of
up2date is available from the Red Hat FTP site and may also be
downloaded directly from the RHN website:

https://access.redhat.com

5. Bug IDs fixed  (  for more info):

121229 - libpng can access out of bounds memory

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS: 


i386:
Available from Red Hat Network: libpng-1.0.14-0.7x.5.i386.rpm
Available from Red Hat Network: libpng-devel-1.0.14-0.7x.5.i386.rpm

ia64:
Available from Red Hat Network: libpng-1.0.14-0.7x.5.ia64.rpm
Available from Red Hat Network: libpng-devel-1.0.14-0.7x.5.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS: 


ia64:
Available from Red Hat Network: libpng-1.0.14-0.7x.5.ia64.rpm
Available from Red Hat Network: libpng-devel-1.0.14-0.7x.5.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS: 


i386:
Available from Red Hat Network: libpng-1.0.14-0.7x.5.i386.rpm
Available from Red Hat Network: libpng-devel-1.0.14-0.7x.5.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS: 


i386:
Available from Red Hat Network: libpng-1.0.14-0.7x.5.i386.rpm
Available from Red Hat Network: libpng-devel-1.0.14-0.7x.5.i386.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS: 
 


i386:
Available from Red Hat Network: libpng-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng10-1.0.13-12.i386.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.i386.rpm

ia64:
Available from Red Hat Network: libpng-1.2.2-21.ia64.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.ia64.rpm
Available from Red Hat Network: libpng10-1.0.13-12.ia64.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.ia64.rpm

ppc:
Available from Red Hat Network: libpng-1.2.2-21.ppc.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.ppc.rpm
Available from Red Hat Network: libpng10-1.0.13-12.ppc.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.ppc.rpm

ppc64:
Available from Red Hat Network: libpng-1.2.2-21.ppc64.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.ppc64.rpm

s390:
Available from Red Hat Network: libpng-1.2.2-21.s390.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.s390.rpm
Available from Red Hat Network: libpng10-1.0.13-12.s390.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.s390.rpm

s390x:
Available from Red Hat Network: libpng-1.2.2-21.s390x.rpm
Available from Red Hat Network: libpng-1.2.2-21.s390.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.s390x.rpm
Available from Red Hat Network: libpng10-1.0.13-12.s390x.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.s390x.rpm

x86_64:
Available from Red Hat Network: libpng-1.2.2-21.x86_64.rpm
Available from Red Hat Network: libpng-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.x86_64.rpm
Available from Red Hat Network: libpng10-1.0.13-12.x86_64.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.x86_64.rpm

Red Hat Desktop version 3:

SRPMS: 
 


i386:
Available from Red Hat Network: libpng-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng10-1.0.13-12.i386.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.i386.rpm

x86_64:
Available from Red Hat Network: libpng-1.2.2-21.x86_64.rpm
Available from Red Hat Network: libpng-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.x86_64.rpm
Available from Red Hat Network: libpng10-1.0.13-12.x86_64.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS: 
 


i386:
Available from Red Hat Network: libpng-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng10-1.0.13-12.i386.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.i386.rpm

ia64:
Available from Red Hat Network: libpng-1.2.2-21.ia64.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.ia64.rpm
Available from Red Hat Network: libpng10-1.0.13-12.ia64.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.ia64.rpm

x86_64:
Available from Red Hat Network: libpng-1.2.2-21.x86_64.rpm
Available from Red Hat Network: libpng-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.x86_64.rpm
Available from Red Hat Network: libpng10-1.0.13-12.x86_64.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS: 
 


i386:
Available from Red Hat Network: libpng-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng10-1.0.13-12.i386.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.i386.rpm

ia64:
Available from Red Hat Network: libpng-1.2.2-21.ia64.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.ia64.rpm
Available from Red Hat Network: libpng10-1.0.13-12.ia64.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.ia64.rpm

x86_64:
Available from Red Hat Network: libpng-1.2.2-21.x86_64.rpm
Available from Red Hat Network: libpng-1.2.2-21.i386.rpm
Available from Red Hat Network: libpng-devel-1.2.2-21.x86_64.rpm
Available from Red Hat Network: libpng10-1.0.13-12.x86_64.rpm
Available from Red Hat Network: libpng10-devel-1.0.13-12.x86_64.rpm



7. Verification:

MD5 sum                          Package Name
- --------------------------------------------------------------------------
897953ceeb05ab68c5be43666923eee1 libpng-1.0.14-0.7x.5.i386.rpm
638a74c33a643c85c44ca800c34c2f7b libpng-1.0.14-0.7x.5.ia64.rpm
1d35c1ac65f01160591f0d60cca2f321 libpng-1.0.14-0.7x.5.src.rpm
18194acdabb9acad8639775058da891d libpng-1.2.2-21.i386.rpm
4d5177ecaa91321284edca4a6137c72b libpng-1.2.2-21.ia64.rpm
fa7ed696d67f9e95e9271a6f82eaa2a7 libpng-1.2.2-21.ppc.rpm
ff4c6abd1403b070b110655bf37f16ee libpng-1.2.2-21.ppc64.rpm
dcd3fcd9e7caaa4216e23458e1108f87 libpng-1.2.2-21.s390.rpm
55b5f90a5dad3c69360835f73c0eb4bc libpng-1.2.2-21.s390x.rpm
a7af7b6b2bd951e48720369a16d73164 libpng-1.2.2-21.src.rpm
a059b12263dcd3f7ffd5ecffd78efad5 libpng-1.2.2-21.x86_64.rpm
914d10cb0ca5f16e936920063e14559c libpng-devel-1.0.14-0.7x.5.i386.rpm
59f4af9d517daa997bc669389d8076d0 libpng-devel-1.0.14-0.7x.5.ia64.rpm
ed1a944854b4ae31e984d5fd6253f8f6 libpng-devel-1.2.2-21.i386.rpm
25004c38f2e935d004eeaecd6da1e78c libpng-devel-1.2.2-21.ia64.rpm
e98b4f626e938513496db87a22d0a874 libpng-devel-1.2.2-21.ppc.rpm
536339b9110eafe626833ef000630720 libpng-devel-1.2.2-21.ppc64.rpm
256c29c24fb5c38b5457b2d892c60e14 libpng-devel-1.2.2-21.s390.rpm
a24c7b7fd082f4f0ccf62714c8469140 libpng-devel-1.2.2-21.s390x.rpm
1d55630e2bae3217527e90186f48f770 libpng-devel-1.2.2-21.x86_64.rpm
c6bd33f12be1ea5209dbd073d5d11930 libpng10-1.0.13-12.i386.rpm
a799756aa33397073e65099a6e256faf libpng10-1.0.13-12.ia64.rpm
d86b8242b6a19fededbe546b1bfa6f21 libpng10-1.0.13-12.ppc.rpm
c90b368cf7bb44aa8266edbc666e57af libpng10-1.0.13-12.s390.rpm
e8bb29a8fece0a01ca3483334a4b9a78 libpng10-1.0.13-12.s390x.rpm
7fd1a18a7a6040de59fa94801cdfc4aa libpng10-1.0.13-12.src.rpm
84b289ad10369db0590a748bec11baab libpng10-1.0.13-12.x86_64.rpm
141ef17820d69a9bac9e9014b650a2e0 libpng10-devel-1.0.13-12.i386.rpm
1d3b8c43e1874270e13a1852e62462a6 libpng10-devel-1.0.13-12.ia64.rpm
e183cc26b8cbaaa78500fb6c39dc5ad5 libpng10-devel-1.0.13-12.ppc.rpm
021581bb52d163c79fdd7c88fea38946 libpng10-devel-1.0.13-12.s390.rpm
cc33a93e86c9946c9c536f7fb287d4aa libpng10-devel-1.0.13-12.s390x.rpm
742e50f2a46bad06225a4e1f00c08376 libpng10-devel-1.0.13-12.x86_64.rpm


These packages are GPG signed by Red Hat for security.  Our key is
available from  

You can verify each package with the following command:
    
    rpm --checksig -v 

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    
    md5sum 


8. References:
 
CVE -CVE-2004-0421

9. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at  

Copyright 2004 Red Hat, Inc.