Advisories » MGASA-2015-0473

Updated libpng packages fix security vulnerabilities

Publication date: 16 Dec 2015
Modification date: 16 Dec 2015
Type: security
Affected Mageia releases : 5
CVE: CVE-2015-8472

Description

Updated libpng and libpng12 packages fix security vulnerability:

The fix for CVE-2015-8126 was incomplete.  While it defended against the
potential overrun while reading PNG files, it did not detect a potential
overrun by applications using png_set_PLTE directly (CVE-2015-8472).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=17304
• http://advisories.mageia.org/MGASA-2015-0451.html
• http://openwall.com/lists/oss-security/2015/12/05/5
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472

SRPMS

5/core

• libpng12-1.2.55-1.mga5
• libpng-1.6.20-1.mga5