Updated libpng packages are available for Mandrakelinux
_______________________________________________________________________

Mandrakelinux Security Update Advisory
_______________________________________________________________________

Package name: libpng
Advisory ID: MDKSA-2004:063
Date: June 29th, 2004

Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1,
Multi Network Firewall 8.2
______________________________________________________________________

Problem Description:

A buffer overflow vulnerability was discovered in libpng due to a wrong calculation of some loop offset values. This buffer overflow can lead to Denial of Service or even remote compromise.

This vulnerability was initially patched in January of 2003, but it has since been noted that fixes were required in two additional places that had not been corrected with the earlier patch. This update uses an updated patch to fix all known issues.

After the upgrade, all applications that use libpng should be restarted. Many applications are linked to libpng, so if you are unsure of what applications to restart, you may wish to reboot the system. Mandrakesoft encourages all users to upgrade immediately.



_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1363
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:008
______________________________________________________________________

Updated Packages:

Mandrakelinux 10.0:
b839285ba258d6e3ccb9d3825b766901 10.0/RPMS/libpng3-1.2.5-10.3.100mdk.i586.rpm
c014991a9204830f782f68254b622a61 10.0/RPMS/libpng3-devel-1.2.5-10.3.100mdk.i586.rpm
84a2c6d319d6bbaf9cf304b1e6075fb8 10.0/RPMS/libpng3-static-devel-1.2.5-10.3.100mdk.i586.rpm
3e33450632704e0c4578b8d37af2113e 10.0/SRPMS/libpng-1.2.5-10.3.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
af1dff46374070937fd9d62475de0254 amd64/10.0/RPMS/lib64png3-1.2.5-10.3.100mdk.amd64.rpm
e4d7de0a42cc27c9543e94bbb89aed80 amd64/10.0/RPMS/lib64png3-devel-1.2.5-10.3.100mdk.amd64.rpm
6e0f39bf485aab02b5791272e37a1c8e amd64/10.0/RPMS/lib64png3-static-devel-1.2.5-10.3.100mdk.amd64.rpm
3e33450632704e0c4578b8d37af2113e amd64/10.0/SRPMS/libpng-1.2.5-10.3.100mdk.src.rpm

Corporate Server 2.1:
e6056c15e8aee840f23fd724801c68c0 corporate/2.1/RPMS/libpng3-1.2.4-3.5.C21mdk.i586.rpm
a4800e9eedac026fb7a6a2ef43dcfd35 corporate/2.1/RPMS/libpng3-devel-1.2.4-3.5.C21mdk.i586.rpm
ca88a0013ce7c6b219b34482f29413f3 corporate/2.1/RPMS/libpng3-static-devel-1.2.4-3.5.C21mdk.i586.rpm
71fffcd387ae67bbd5b9ed3e3d8e37e3 corporate/2.1/SRPMS/libpng-1.2.4-3.5.C21mdk.src.rpm

Corporate Server 2.1/x86_64:
f01d40d1f4456b99b3e0b45ab9a75ad6 x86_64/corporate/2.1/RPMS/libpng3-1.2.4-3.5.C21mdk.x86_64.rpm
e0a8f3aebfdebd1f301dd6a609c3fb14 x86_64/corporate/2.1/RPMS/libpng3-devel-1.2.4-3.5.C21mdk.x86_64.rpm
aa5e793c0fcfde7acb582ca308eafaa6 x86_64/corporate/2.1/RPMS/libpng3-static-devel-1.2.4-3.5.C21mdk.x86_64.rpm
71fffcd387ae67bbd5b9ed3e3d8e37e3 x86_64/corporate/2.1/SRPMS/libpng-1.2.4-3.5.C21mdk.src.rpm

Mandrakelinux 9.1:
47b7136e0ffc87022f0c7b61ba180ede 9.1/RPMS/libpng3-1.2.5-2.3.91mdk.i586.rpm
8ef669612a5eac43f41cd0b7c9e23c86 9.1/RPMS/libpng3-devel-1.2.5-2.3.91mdk.i586.rpm
7f9b1b1f639fca07a38abdfa37d79c8b 9.1/RPMS/libpng3-static-devel-1.2.5-2.3.91mdk.i586.rpm
28d3472cfbd53a9b312281cfdb6351b9 9.1/SRPMS/libpng-1.2.5-2.3.91mdk.src.rpm

Mandrakelinux 9.1/PPC:
aa334eb90f70b4053db434b64089d35d ppc/9.1/RPMS/libpng3-1.2.5-2.3.91mdk.ppc.rpm
9e2a767d6fe67a949016d971e6c5bc46 ppc/9.1/RPMS/libpng3-devel-1.2.5-2.3.91mdk.ppc.rpm
7229990aa45e8584c005859db97144b2 ppc/9.1/RPMS/libpng3-static-devel-1.2.5-2.3.91mdk.ppc.rpm
28d3472cfbd53a9b312281cfdb6351b9 ppc/9.1/SRPMS/libpng-1.2.5-2.3.91mdk.src.rpm

Mandrakelinux 9.2:
715a708ef3c4f25ce94908558ca1b0a2 9.2/RPMS/libpng3-1.2.5-7.3.92mdk.i586.rpm
dbe789399e2034fe5a024ce7b6e9a3ed 9.2/RPMS/libpng3-devel-1.2.5-7.3.92mdk.i586.rpm
c79e966637991ab3520720f745f0a21e 9.2/RPMS/libpng3-static-devel-1.2.5-7.3.92mdk.i586.rpm
f4488ff6b1da53cd02a43658f541f6ec 9.2/SRPMS/libpng-1.2.5-7.3.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
222378f78f5047c7941b1d3d0ab82184 amd64/9.2/RPMS/lib64png3-1.2.5-7.3.92mdk.amd64.rpm
ed110a49ff14580d9e011a19d120c712 amd64/9.2/RPMS/lib64png3-devel-1.2.5-7.3.92mdk.amd64.rpm
30e005b0d91d77f21dce2833106f69a3 amd64/9.2/RPMS/lib64png3-static-devel-1.2.5-7.3.92mdk.amd64.rpm
f4488ff6b1da53cd02a43658f541f6ec amd64/9.2/SRPMS/libpng-1.2.5-7.3.92mdk.src.rpm

Multi Network Firewall 8.2:
49f7119cd8a449fb77ab32070b0f5843 mnf8.2/RPMS/libpng3-1.2.4-3.5.M82mdk.i586.rpm
a4b220d9b228cd6d0bac2854682f1a24 mnf8.2/SRPMS/libpng-1.2.4-3.5.M82mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandrakesoft for security. You can obtain the GPG public key of the Mandrakelinux Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandrakelinux at:

http://www.mandrakesoft.com/security/advisories

If you want to report vulnerabilities, please contact

security_linux-mandrake.com