Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 244808 (CVE-2008-6218) - media-libs/libpng <1.2.33 "png_handle_tEXt()" Memory Leak Vulnerability (CVE-2008-6218)
Summary: media-libs/libpng <1.2.33 "png_handle_tEXt()" Memory Leak Vulnerability (CVE-...
Status: RESOLVED FIXED
Alias: CVE-2008-6218
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL: http://secunia.com/advisories/32418/
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks: 249026
  Show dependency tree
 
Reported: 2008-10-28 18:49 UTC by Matti Bickel (RETIRED)
Modified: 2009-03-15 18:46 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
libpng-1.2.33rc02-1.2.33rc01.patch (libpng-1.2.33rc02-1.2.33rc01.patch,3.29 KB, patch)
2008-10-28 19:39 UTC, Robert Buchholz (RETIRED)
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Matti Bickel (RETIRED) gentoo-dev 2008-10-28 18:49:42 UTC
From secunia:

CRITICAL:
Not critical

IMPACT:
DoS

WHERE:
From remote

SOFTWARE:
libpng 1.x
http://secunia.com/advisories/product/3439/

DESCRIPTION:
A vulnerability has been reported in libpng, which can be exploited
by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a memory leak error within the
"png_handle_tEXt()" function in pngrutil.c. This can be exploited to
potentially exhaust all available memory via a specially crafted PNG
image.

The vulnerability is reported in version 1.2.32. Other versions may
also be affected.

SOLUTION:
Fixed in version 1.2.33rc02.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://sourceforge.net/project/shownotes.php?release_id=635463&group_id=5624
Comment 1 Matti Bickel (RETIRED) gentoo-dev 2008-10-28 18:55:17 UTC
base-system, can we have a unaffected version (libpng-1.2.33rc02 is what secunia says), please?
Comment 2 Robert Buchholz (RETIRED) gentoo-dev 2008-10-28 19:39:06 UTC
Created attachment 170150 [details, diff]
libpng-1.2.33rc02-1.2.33rc01.patch

changes from rc01 to rc02
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2008-10-28 19:42:17 UTC
The patch applies to 1.2.26 as well (with some fuzz), but png_struct was changed since then, so it does not work.
Comment 4 SpanKY gentoo-dev 2008-11-29 21:38:15 UTC
FYI libpng-1.2.33 is in the tree and has been for a while ...
Comment 5 Robert Buchholz (RETIRED) gentoo-dev 2008-11-30 02:33:08 UTC
Arches, please test and mark stable:
=media-libs/libpng-1.2.33
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"
Comment 6 Markus Meier gentoo-dev 2008-11-30 14:50:21 UTC
amd64/x86 stable
Comment 7 Tobias Scherbaum (RETIRED) gentoo-dev 2008-11-30 21:20:35 UTC
ppc stable
Comment 8 Jeroen Roovers gentoo-dev 2008-12-01 06:37:12 UTC
Stable for HPPA.
Comment 9 Raúl Porcel (RETIRED) gentoo-dev 2008-12-01 11:11:02 UTC
alpha/arm/ia64/sparc stable
Comment 10 Brent Baude (RETIRED) gentoo-dev 2008-12-01 15:18:17 UTC
ppc64 done
Comment 11 Tobias Heinlein (RETIRED) gentoo-dev 2008-12-09 22:39:26 UTC
Ready for vote, I vote YES.
Comment 12 Stefan Behte (RETIRED) gentoo-dev Security 2009-01-11 18:45:09 UTC
Yes, too. Request filed.
Comment 13 Pierre-Yves Rofes (RETIRED) gentoo-dev 2009-03-15 18:46:07 UTC
GLSA 200903-28