Bug 244808 – media-libs/libpng <1.2.33 "png_handle_tEXt()" Memory Leak Vulnerability (CVE-2008-6218)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Matti Bickel (RETIRED) 2008-10-28 18:49:42 UTC]

From secunia:

CRITICAL:
Not critical

IMPACT:
DoS

WHERE:
From remote

SOFTWARE:
libpng 1.x
http://secunia.com/advisories/product/3439/

DESCRIPTION:
A vulnerability has been reported in libpng, which can be exploited
by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a memory leak error within the
"png_handle_tEXt()" function in pngrutil.c. This can be exploited to
potentially exhaust all available memory via a specially crafted PNG
image.

The vulnerability is reported in version 1.2.32. Other versions may
also be affected.

SOLUTION:
Fixed in version 1.2.33rc02.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://sourceforge.net/project/shownotes.php?release_id=635463&group_id=5624

[Comment 1 Matti Bickel (RETIRED) 2008-10-28 18:55:17 UTC]

base-system, can we have a unaffected version (libpng-1.2.33rc02 is what secunia says), please?

[Comment 2 Robert Buchholz (RETIRED) 2008-10-28 19:39:06 UTC]

Created attachment 170150 [details, diff]
libpng-1.2.33rc02-1.2.33rc01.patch

changes from rc01 to rc02

[Comment 3 Robert Buchholz (RETIRED) 2008-10-28 19:42:17 UTC]

The patch applies to 1.2.26 as well (with some fuzz), but png_struct was changed since then, so it does not work.

[Comment 4 SpanKY 2008-11-29 21:38:15 UTC]

FYI libpng-1.2.33 is in the tree and has been for a while ...

[Comment 5 Robert Buchholz (RETIRED) 2008-11-30 02:33:08 UTC]

Arches, please test and mark stable:
=media-libs/libpng-1.2.33
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"

[Comment 6 Markus Meier 2008-11-30 14:50:21 UTC]

amd64/x86 stable

[Comment 7 Tobias Scherbaum (RETIRED) 2008-11-30 21:20:35 UTC]

ppc stable

[Comment 8 Jeroen Roovers (RETIRED) 2008-12-01 06:37:12 UTC]

Stable for HPPA.

[Comment 9 Raúl Porcel (RETIRED) 2008-12-01 11:11:02 UTC]

alpha/arm/ia64/sparc stable

[Comment 10 Brent Baude (RETIRED) 2008-12-01 15:18:17 UTC]

ppc64 done

[Comment 11 Tobias Heinlein (RETIRED) 2008-12-09 22:39:26 UTC]

Ready for vote, I vote YES.

[Comment 12 Stefan Behte (RETIRED) 2009-01-11 18:45:09 UTC]

Yes, too. Request filed.

[Comment 13 Pierre-Yves Rofes (RETIRED) 2009-03-15 18:46:07 UTC]

GLSA 200903-28