Updated libpng packages has been released for Slackware Linux:
New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to fix security issues. These issues could cause program crashes, or possibly allow arbitrary code embedded in a malicious PNG image to execute. The PNG library is widely used within the system, so all sites should upgrade to the new libpng package.
More details about these issues may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599
Here are the details from the Slackware 10.0 ChangeLog:
+--------------------------+
Sat Aug 7 17:17:20 PDT 2004
patches/packages/libpng-1.2.5-i486-3.tgz: Patched possible security issues including buffer and integer overflows and null pointer references. These issues could cause program crashes, or possibly allow arbitrary code embedded in a malicious PNG image to execute. The PNG library is widely used within the system, so all sites should upgrade to the new libpng package. For more details, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/libpng-1.2.5-i386-1.tgz
Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/libpng-1.2.5-i386-2.tgz
Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/libpng-1.2.5-i486-3.tgz
Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/libpng-1.2.5-i486-3.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libpng-1.2.5-i486-3.tgz
MD5 signatures:
+-------------+
Slackware 8.1 package:
be08f3ea7e8b41a3fd7ce49a676617e0 libpng-1.2.5-i386-1.tgz
Slackware 9.0 package:
6c68e6a65850e26b60651d65fd8c0a2f libpng-1.2.5-i386-2.tgz
Slackware 9.1 package:
4fcf53708102839f3cac78a99d05e750 libpng-1.2.5-i486-3.tgz
Slackware 10.0 package:
094a9825c51204a9aa2cb0bbb43b7a64 libpng-1.2.5-i486-3.tgz
Slackware -current package:
094a9825c51204a9aa2cb0bbb43b7a64 libpng-1.2.5-i486-3.tgz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg libpng-1.2.5-i486-3.tgz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to fix security issues. These issues could cause program crashes, or possibly allow arbitrary code embedded in a malicious PNG image to execute. The PNG library is widely used within the system, so all sites should upgrade to the new libpng package.
More details about these issues may be found in the Common Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599
Here are the details from the Slackware 10.0 ChangeLog:
+--------------------------+
Sat Aug 7 17:17:20 PDT 2004
patches/packages/libpng-1.2.5-i486-3.tgz: Patched possible security issues including buffer and integer overflows and null pointer references. These issues could cause program crashes, or possibly allow arbitrary code embedded in a malicious PNG image to execute. The PNG library is widely used within the system, so all sites should upgrade to the new libpng package. For more details, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/libpng-1.2.5-i386-1.tgz
Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/libpng-1.2.5-i386-2.tgz
Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/libpng-1.2.5-i486-3.tgz
Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/libpng-1.2.5-i486-3.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/libpng-1.2.5-i486-3.tgz
MD5 signatures:
+-------------+
Slackware 8.1 package:
be08f3ea7e8b41a3fd7ce49a676617e0 libpng-1.2.5-i386-1.tgz
Slackware 9.0 package:
6c68e6a65850e26b60651d65fd8c0a2f libpng-1.2.5-i386-2.tgz
Slackware 9.1 package:
4fcf53708102839f3cac78a99d05e750 libpng-1.2.5-i486-3.tgz
Slackware 10.0 package:
094a9825c51204a9aa2cb0bbb43b7a64 libpng-1.2.5-i486-3.tgz
Slackware -current package:
094a9825c51204a9aa2cb0bbb43b7a64 libpng-1.2.5-i486-3.tgz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg libpng-1.2.5-i486-3.tgz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
