Your message dated Fri, 15 Jul 2011 03:32:12 +0000
with message-id <[email protected]>
and subject line Bug#633871: fixed in libpng 1.2.46-1
has caused the Debian Bug report #633871,
regarding Three security issues
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
633871: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633871
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libpng
Severity: grave
Tags: security
Three security issues have been reported in libpng. Please see
the following links to CVE IDs and Red Hat bugzilla:
1. buffer overwrite in png_rgb_to_gray
CVE: CVE-2011-2690
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=720607
2. Crash in png_default_error due to use of NULL Pointer
CVE: CVE-2011-2691
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=720608
3. Memory corruption when handling empty sCAL chunks
CVE: CVE-2011-2692
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=720612
Cheers,
Moritz
--- End Message ---
--- Begin Message ---
Source: libpng
Source-Version: 1.2.46-1
We believe that the bug you reported is fixed in the latest version of
libpng, which is due to be installed in the Debian FTP archive:
libpng12-0-udeb_1.2.46-1_amd64.udeb
to main/libp/libpng/libpng12-0-udeb_1.2.46-1_amd64.udeb
libpng12-0_1.2.46-1_amd64.deb
to main/libp/libpng/libpng12-0_1.2.46-1_amd64.deb
libpng12-dev_1.2.46-1_amd64.deb
to main/libp/libpng/libpng12-dev_1.2.46-1_amd64.deb
libpng3_1.2.46-1_all.deb
to main/libp/libpng/libpng3_1.2.46-1_all.deb
libpng_1.2.46-1.debian.tar.bz2
to main/libp/libpng/libpng_1.2.46-1.debian.tar.bz2
libpng_1.2.46-1.dsc
to main/libp/libpng/libpng_1.2.46-1.dsc
libpng_1.2.46.orig.tar.gz
to main/libp/libpng/libpng_1.2.46.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Nobuhiro Iwamatsu <[email protected]> (supplier of updated libpng package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Fri, 15 Jul 2011 11:47:49 +0900
Source: libpng
Binary: libpng12-0 libpng12-dev libpng3 libpng12-0-udeb
Architecture: source all amd64
Version: 1.2.46-1
Distribution: unstable
Urgency: high
Maintainer: Anibal Monsalve Salazar <[email protected]>
Changed-By: Nobuhiro Iwamatsu <[email protected]>
Description:
libpng12-0 - PNG library - runtime
libpng12-0-udeb - PNG library - minimal runtime library (udeb)
libpng12-dev - PNG library - development
libpng3 - PNG library - runtime
Closes: 633871
Changes:
libpng (1.2.46-1) unstable; urgency=high
.
* New upstream release (Closes: #633871).
- Fix CVE: CVE-2011-2690
Buffer overwrite in png_rgb_to_gray
- CVE: CVE-2011-2691
Crash in png_default_error due to use of NULL Pointer
- CVE: CVE-2011-2692
Memory corruption when handling empty sCAL chunks
- Update patches/01-legacy.patch
- Remove patches/02-632786-CVE-2011-2501.patch. Applied to upstream.
Checksums-Sha1:
990f102856b290e09f01baf00dc52a001a03c152 1813 libpng_1.2.46-1.dsc
d5f3a2439b0b6d85a26499b2be09918eb54ea13a 831390 libpng_1.2.46.orig.tar.gz
fdba7547b33f919f220a5ad828f85c0a089bc586 15295 libpng_1.2.46-1.debian.tar.bz2
120f48da8861a6c209baa21b28ea78250f2f5a27 906 libpng3_1.2.46-1_all.deb
b162d1e97fcd08c4eb91f78fc1570972878d2d98 181064 libpng12-0_1.2.46-1_amd64.deb
49f4468e8626b8fabe914f1c725381bc783494d6 273192 libpng12-dev_1.2.46-1_amd64.deb
5e1a13a441d59a502af1df1751082e6d31f47860 74020
libpng12-0-udeb_1.2.46-1_amd64.udeb
Checksums-Sha256:
014a320ba36a7eef270c2c89f2889cacfe267ab830d6817f950d3bfb18ebe448 1813
libpng_1.2.46-1.dsc
3d8fd4c88d19b7fcf981e9d9adad9195e1a1cfbb7bcb9e76a2bd602d6e3ae781 831390
libpng_1.2.46.orig.tar.gz
94a633ca818bca8a298aeb02ccbef9597911b8b4ae381895d3eb972f186c72a6 15295
libpng_1.2.46-1.debian.tar.bz2
3f410cc8dd8088837966657f5fffd64ca79e2e1e344a4fca8551fcb4a12a0c86 906
libpng3_1.2.46-1_all.deb
85676ad64c60b21b42900295415461f5e18403fdfe8475bdafe5b47e301633db 181064
libpng12-0_1.2.46-1_amd64.deb
613bc1476a3cb35e416a59c62caffc45be6012d64b7133970a6a9dabd9cbad6e 273192
libpng12-dev_1.2.46-1_amd64.deb
2499121411ea74646f53233ccd881d9473a8771c9dda6c948d344f621ab799be 74020
libpng12-0-udeb_1.2.46-1_amd64.udeb
Files:
f284b2268a75261dd27359d571a43fd2 1813 libs optional libpng_1.2.46-1.dsc
03ddfc17ad321db93f984581e9415d22 831390 libs optional libpng_1.2.46.orig.tar.gz
5f1fb3ed312b15be25df452af03e36cb 15295 libs optional
libpng_1.2.46-1.debian.tar.bz2
d0de6bb21f110d2a60de9337a781b47c 906 oldlibs optional libpng3_1.2.46-1_all.deb
0b5de44372009ce2f8dd7bb6ed843dea 181064 libs optional
libpng12-0_1.2.46-1_amd64.deb
8d31c01b661b7287aae8cde1691c5df5 273192 libdevel optional
libpng12-dev_1.2.46-1_amd64.deb
5a9e25f1e566de14d826a5bdbd9aa3a6 74020 debian-installer extra
libpng12-0-udeb_1.2.46-1_amd64.udeb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBCAAGBQJOH7CZAAoJEDIkf7tArR+m2s0QAImjd73h/USu6itNv00drTip
fqRdzaiqz1Oepj7j0miQ4tlk3MOYcaIaNxINIycWfNMGfodyzJ229u8L2Z+11bfm
Cglf6HpYQb2gQ9P1xmUV1GX/QMlvzuHB+zCMk73y5m5thR805rQHHZTCt++5o83c
HcE5ORlYnmLF6J8kuga+NHIxRJN9KuWjVOB71x3fs+gxe7quFygdP3jiEtPKcWho
aoMlLhM27oYt+eFUPoOiogNDOMYwFg7nRJVM85Y/olQUKlWN6dJ9eWoBPoEtqIm9
A+c30nHmi2jEkdSsi9KW7/ijuY3y7qWZU2fleZ6KLrT2d1Etnd9wVedHs9fvagVL
bC5xFul1egi0vrze00nHo61tg9RAVJTDbzrwHhah0sGYhlI84MxsiG4xwZPgV8/a
2rA7CWVbKB8K9zbZtdEkqqF/BQcHWqBGIWW0t35aAKk3ZDYWQOiIUNOd5uHyvSty
xG+2LcTrqB6Fl5VaHnzY9rHKuWoJXYQ71J90RRYjM9a7GBWKZuFaQSRuWs6X1uKB
V+L1ptUqCJ9qIupAaZstlHAwf/qH6bUQQHNSDbTA6X+1CG9sZOr7GkAPwCp5ISMS
gcsQPtoGm0Lx+BDst1FYPoyr5SxQb5RbkyaYAMaHlI9qexrjOKRkPpLNXDvxvcr3
b98/pQmH8JA4ztd7Js1q
=R1lH
-----END PGP SIGNATURE-----
--- End Message ---
