Advisories » MGASA-2014-0076

Updated libpng12 package fixes security vulnerability

Publication date: 16 Feb 2014
Modification date: 16 Feb 2014
Type: security
Affected Mageia releases : 4
CVE: CVE-2013-6954

Description

The png_do_expand_palette function in libpng before 1.6.8 allows remote
attackers to cause a denial of service (NULL pointer dereference and
application crash) via a PLTE chunk of zero bytes or a NULL palette, related
to pngrtran.c and pngset.c (CVE-2013-6954).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=12747
• https://lists.fedoraproject.org/pipermail/package-announce/2014-February/128099.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6954

SRPMS

4/core

• libpng12-1.2.50-4.1.mga4