[Bug 1281756] New: CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

List overview All Threads
Download

newer

older

[Bug 1262853] New: mingw-libxml2:...

[Bug 851819] New: Review Request:...

Red Hat Bugzilla

13 Nov 2015 13 Nov '15

11:54 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Bug ID: 1281756 Summary: CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: drizt@land.ru, erik-fedora@vanpienbroek.nl, fedora-mingw@lists.fedoraproject.org, ktietz@redhat.com, lfarkas@lfarkas.org, paul@city-fan.org, phracek@redhat.com, rjones@redhat.com

Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8.

Affected versions of libpng are before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19.

Upstream patches:

https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b... https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208... https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57... https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba...

CVE assignment:

http://seclists.org/oss-sec/2015/q4/264

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=kwjqAGuHqm&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

13 Nov 13 Nov

11:55 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Adam Mariš amaris@redhat.com changed:

--- Comment #1 from Adam Mariš amaris@redhat.com ---

Created libpng tracking bugs for this issue:

Affects: fedora-all [bug 1281757]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1281757 [Bug 1281757] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1281758 [Bug 1281758] CVE-2015-8126 mingw-libpng: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1281759 [Bug 1281759] CVE-2015-8126 libpng10: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1281760 [Bug 1281760] CVE-2015-8126 mingw-libpng: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [epel-7]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=pjERsi2qcI&a=cc_unsubscribe

Red Hat Bugzilla

11:55 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #2 from Adam Mariš amaris@redhat.com ---

Created libpng10 tracking bugs for this issue:

Affects: epel-6 [bug 1281759]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VAltVP1RWD&a=cc_unsubscribe

Red Hat Bugzilla

11:56 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #3 from Adam Mariš amaris@redhat.com ---

Created mingw-libpng tracking bugs for this issue:

Affects: fedora-all [bug 1281758] Affects: epel-7 [bug 1281760]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=dzOurPxEW0&a=cc_unsubscribe

Red Hat Bugzilla

11:59 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1281763

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=FNLbjQtg3B&a=cc_unsubscribe

Red Hat Bugzilla

12:11 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #4 from Paul Howarth paul@city-fan.org --- (In reply to Adam Mariš from comment #2)

...

Created libpng10 tracking bugs for this issue:

Affects: epel-6 [bug 1281759]

It affects fedora-all too. I'll edit the existing updates for 1.0.64 when a suitable tracking bug is generated.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=DKyKqvadON&a=cc_unsubscribe

Red Hat Bugzilla

14 Nov 14 Nov

1:49 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Paul Howarth paul@city-fan.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1282039

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1282039 [Bug 1282039] libpng10: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=eGCzCUQrD1&a=cc_unsubscribe

Red Hat Bugzilla

16 Nov 16 Nov

5:39 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6xGHr0Isoj&a=cc_unsubscribe

Red Hat Bugzilla

2:24 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Raphael Groner projects.rg@smart.ms changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |projects.rg@smart.ms

--- Comment #5 from Raphael Groner projects.rg@smart.ms --- Besides libpng, all those compat packages need to be updated, too: libpng10, libpng12, libpng15 Please do so ASAP.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=A8LywpnIaB&a=cc_unsubscribe

Red Hat Bugzilla

2:28 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Piotr Popieluch piotr1212@gmail.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=0m16LyurCw&a=cc_unsubscribe

Red Hat Bugzilla

17 Nov 17 Nov

12:46 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #6 from Stefan Cornelius scorneli@redhat.com --- This needs another patch: https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15b...

Or there will be CRC issues. I'll also add this to the list of patches in comment #0.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=y0ZigTi288&a=cc_unsubscribe

Red Hat Bugzilla

4:25 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=a2HODHfJLJ&a=cc_unsubscribe

Red Hat Bugzilla

6:45 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qiHlLPSmZI&a=cc_unsubscribe

Red Hat Bugzilla

6:47 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Stefan Cornelius scorneli@redhat.com changed:

--- Comment #8 from Stefan Cornelius scorneli@redhat.com ---

Created libpng12 tracking bugs for this issue:

Affects: fedora-all [bug 1282901]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1282901 [Bug 1282901] CVE-2015-8126 libpng12: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1282902 [Bug 1282902] CVE-2015-8126 libpng15: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=LIh58aEB8h&a=cc_unsubscribe

Red Hat Bugzilla

6:48 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #9 from Stefan Cornelius scorneli@redhat.com ---

Created libpng15 tracking bugs for this issue:

Affects: fedora-all [bug 1282902]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bxbkXPZaQD&a=cc_unsubscribe

Red Hat Bugzilla

18 Nov 18 Nov

8:13 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Petr Hracek phracek@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6Db0UDTgWc&a=cc_unsubscribe

Red Hat Bugzilla

9:06 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Adam Mariš amaris@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=FfVej2Cbfm&a=cc_unsubscribe

Red Hat Bugzilla

2:44 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Severity|urgent |medium

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=reGFhzWNkS&a=cc_unsubscribe

Red Hat Bugzilla

19 Nov 19 Nov

10:30 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=x9SSKH8dw4&a=cc_unsubscribe

Red Hat Bugzilla

22 Nov 22 Nov

2:22 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #15 from Fedora Update System updates@fedoraproject.org --- libpng-1.6.17-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=M1EEEpSaIi&a=cc_unsubscribe

Red Hat Bugzilla

2:22 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1281757, which changed state.

Bug 1281757 Summary: CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1281757

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=n8T1kb1N6N&a=cc_unsubscribe

Red Hat Bugzilla

24 Nov 24 Nov

3:19 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Petr Hracek phracek@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AHXZvKfFmR&a=cc_unsubscribe

Red Hat Bugzilla

7:51 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #17 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.64-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=f0jTItLPGJ&a=cc_unsubscribe

Red Hat Bugzilla

7:52 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1282039, which changed state.

Bug 1282039 Summary: CVE-2015-8126 libpng10: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1282039

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=c1lVPHKYf3&a=cc_unsubscribe

Red Hat Bugzilla

10:24 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #18 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.64-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=YnnV6vBtxS&a=cc_unsubscribe

Red Hat Bugzilla

10:49 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #19 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.64-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=m6pW50hDR2&a=cc_unsubscribe

Red Hat Bugzilla

26 Nov 26 Nov

9:23 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ZGZ9Y4nzKG&a=cc_unsubscribe

Red Hat Bugzilla

9:47 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #20 from Stefan Cornelius scorneli@redhat.com --- Our CVSSv2 score may be different from what other sources suggest. That's because we don't think that other CVSSv2 score give an appropriate approximation of the real-life impact of this issue.

In order to be vulnerable, an application needs to calculate the exact minimum buffer space for the palette according to the image's bit depth and then has to interact with libpng in a way that would copy the palette into the buffer the application has reserved.

This is an extra-effort step most applications do not take, for simplicity reasons. Instead, for example, a lot of applications use the maximum size the palette can possibly have, regardless of the image's bit depth. In such a case, the application would not be vulnerable, even when using a vulnerable libpng version.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=GiYX7aCy3k&a=cc_unsubscribe

Red Hat Bugzilla

10 a.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cBEWJ5UX3A&a=cc_unsubscribe

Red Hat Bugzilla

27 Nov 27 Nov

6:21 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #25 from Fedora Update System updates@fedoraproject.org --- mingw-libpng-1.6.19-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=i9v21epTMH&a=cc_unsubscribe

Red Hat Bugzilla

6:21 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1281758, which changed state.

Bug 1281758 Summary: CVE-2015-8126 mingw-libpng: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1281758

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=NzjaXZ1Yn0&a=cc_unsubscribe

Red Hat Bugzilla

8:52 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #26 from Fedora Update System updates@fedoraproject.org --- mingw-libpng-1.6.19-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=GL1zYQoCOo&a=cc_unsubscribe

Red Hat Bugzilla

28 Nov 28 Nov

11:17 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #27 from Fedora Update System updates@fedoraproject.org --- mingw-libpng-1.6.19-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HAS3jhZBWQ&a=cc_unsubscribe

Red Hat Bugzilla

30 Nov 30 Nov

9:58 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #28 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.64-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=8vlTmICdIP&a=cc_unsubscribe

Red Hat Bugzilla

9:58 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1281759, which changed state.

Bug 1281759 Summary: CVE-2015-8126 libpng10: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1281759

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ilPbRwadkH&a=cc_unsubscribe

Red Hat Bugzilla

4 Dec 4 Dec

4:50 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1282039, which changed state.

Bug 1282039 Summary: CVE-2015-8126 libpng10: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1282039

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=tX8Uyjwh8r&a=cc_unsubscribe

Red Hat Bugzilla

5 Dec 5 Dec

8:49 p.m.

New subject: [Bug 1281756] CVE-2015-8126 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1281759, which changed state.

Bug 1281759 Summary: CVE-2015-8126 libpng10: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1281759

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=3KOqANwN9c&a=cc_unsubscribe

Red Hat Bugzilla

7 Dec 7 Dec

1:56 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Adam Mariš amaris@redhat.com changed:

--- Comment #29 from Adam Mariš amaris@redhat.com --- CVE-2015-8472 was assigned after it was discovered that initial patch was incomplete. libpng and libpng12 as shipped in RHEL 6 and 7 are not affected by this CVE, since we've already applied complete patch to fix the original issue.

http://seclists.org/oss-sec/2015/q4/439

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=y4KkbISuNQ&a=cc_unsubscribe

Red Hat Bugzilla

8 Dec 8 Dec

2:54 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- An array-indexing error was discovered in the png_convert_to_rfc1123() function of libpng. An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Bx4uJArTVk&a=cc_unsubscribe

Red Hat Bugzilla

9 Dec 9 Dec

1:37 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #30 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 6

Via RHSA-2015:2594 https://rhn.redhat.com/errata/RHSA-2015-2594.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=EKO085hoQw&a=cc_unsubscribe

Red Hat Bugzilla

2:13 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #31 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 7

Via RHSA-2015:2596 https://rhn.redhat.com/errata/RHSA-2015-2596.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=aZoqnpHkVo&a=cc_unsubscribe

Red Hat Bugzilla

2:14 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #32 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 7

Via RHSA-2015:2595 https://rhn.redhat.com/errata/RHSA-2015-2595.html

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vuRzc4jI7V&a=cc_unsubscribe

Red Hat Bugzilla

18 Dec 18 Dec

7:53 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #33 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.65-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=g4OMOmmUaJ&a=cc_unsubscribe

Red Hat Bugzilla

7:54 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1282039, which changed state.

Bug 1282039 Summary: CVE-2015-8126 libpng10: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1282039

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HH98Eb2jYP&a=cc_unsubscribe

Red Hat Bugzilla

9:17 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5HZoNPOkEh&a=cc_unsubscribe

Red Hat Bugzilla

9:58 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #34 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.65-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=YVNl4T1VJx&a=cc_unsubscribe

Red Hat Bugzilla

2 Jan 2 Jan

10:21 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #35 from Fedora Update System updates@fedoraproject.org --- libpng12-1.2.56-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=n8AZH7utO7&a=cc_unsubscribe

Red Hat Bugzilla

10:21 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1282901, which changed state.

Bug 1282901 Summary: CVE-2015-8126 libpng12: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1282901

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1Kz8ulm8eC&a=cc_unsubscribe

Red Hat Bugzilla

11:19 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #36 from Fedora Update System updates@fedoraproject.org --- libpng12-1.2.56-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=JR8dYY6EeW&a=cc_unsubscribe

Red Hat Bugzilla

3 Jan 3 Jan

8:25 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #37 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.66-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=unAHyKM2da&a=cc_unsubscribe

Red Hat Bugzilla

8:26 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1281759, which changed state.

Bug 1281759 Summary: CVE-2015-8126 libpng10: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1281759

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=I86UYxIQnX&a=cc_unsubscribe

Red Hat Bugzilla

4 Jan 4 Jan

6:52 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #38 from Fedora Update System updates@fedoraproject.org --- libpng15-1.5.25-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=e6OQ99oj2h&a=cc_unsubscribe

Red Hat Bugzilla

6:52 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1282902, which changed state.

Bug 1282902 Summary: CVE-2015-8126 libpng15: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1282902

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=y7YqerIPQv&a=cc_unsubscribe

Red Hat Bugzilla

7:57 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #39 from Fedora Update System updates@fedoraproject.org --- libpng15-1.5.25-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Zv0LnqUCny&a=cc_unsubscribe

Red Hat Bugzilla

7 Jan 7 Jan

4:22 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #40 from Fedora Update System updates@fedoraproject.org --- libpng-1.6.17-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=roRFLwTdFR&a=cc_unsubscribe

Red Hat Bugzilla

18 Jan 18 Jan

9:18 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Tomas Hoger thoger@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1295699

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

19 Jan 19 Jan

10:34 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

20 Jan 20 Jan

2:01 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #41 from Tomas Hoger thoger@redhat.com --- OpenJDK 8 upstream commits:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/817a472b15bd http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/23a6e0931277

Note that the first commit actually downgraded bundled libpng from 1.6.16 to 1.5.4, and only the second one upgraded it again to 1.6.20 which includes fixes for CVE-2015-8126 and CVE-2015-8472.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

21 Jan 21 Jan

11:23 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #42 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:0057 https://rhn.redhat.com/errata/RHSA-2016-0057.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

11:39 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #43 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:0056 https://rhn.redhat.com/errata/RHSA-2016-0056.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

11:40 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #44 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2016:0055 https://rhn.redhat.com/errata/RHSA-2016-0055.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

29 Jan 29 Jan

12:06 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

12:06 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

1 Feb 1 Feb

9:02 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

2 Feb 2 Feb

10:05 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #45 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2016:0101 https://rhn.redhat.com/errata/RHSA-2016-0101.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

10:06 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #46 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2016:0100 https://rhn.redhat.com/errata/RHSA-2016-0100.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

1:39 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #47 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Supplementary for Red Hat Enterprise Linux 7

Via RHSA-2016:0098 https://rhn.redhat.com/errata/RHSA-2016-0098.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

1:53 p.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756

--- Comment #48 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Supplementary for Red Hat Enterprise Linux 7 Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2016:0099 https://rhn.redhat.com/errata/RHSA-2016-0099.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

17 Feb 17 Feb

3:56 a.m.

New subject: [Bug 1281756] CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions

https://bugzilla.redhat.com/show_bug.cgi?id=1281756 Bug 1281756 depends on bug 1281760, which changed state.

Bug 1281760 Summary: CVE-2015-8126 mingw-libpng: libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1281760

-- You are receiving this mail because: You are on the CC list for the bug.

3151

Age (days ago)

3247

Last active (days ago)

mingw@lists.fedoraproject.org

68 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla