Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 486
Alerts This Week
Warning Icon 1 486

Fedora 24: 2017:0011-1 Critical: libpng10 NULL Pointer Dereference

fedora
Calendar Grey January 7, 2017
Dist Fedora Esm H88
Addresses a NULL pointer dereference vulnerability in libpng10, complete with crucial security updates for Fedora 24. Ensure you upgrade promptly to maintain system security.
This update fixes an old NULL pointer dereference bug in png_set_text_2() discovered and patched by Patrick Keshishian (CVE-2016-10087)

Summary

The libpng10 package contains an old version of libpng, a library of functions

for creating and manipulating PNG (Portable Network Graphics) image format

files.

This package is needed if you want to run binaries that were linked dynamically

with libpng 1.0.x.

Update Information:

This update fixes an old NULL pointer dereference bug in png_set_text_2() discovered and patched by Patrick Keshishian (CVE-2016-10087). The potential "NULL dereference" bug has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened. The update also fixes some documentation typos and an instance of undefined behavior.

Topics%20covered

Topics Covered

security advisory update Fedora software fix libpng NULL dereference

Change Log

References


[ 1 ] Bug #1409617 - CVE-2016-10087 libpng: NULL pointer dereference in png_set_text_2() https://bugzilla.redhat.com/show_bug.cgi?id=1409617

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade libpng10' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
critical
Lowest
Low
Medium
High
Critical

Name: libpng10
Product: Fedora 24
Version: 1.0.67
Release: 1.fc24
URL: http://www.libpng.org/pub/png/libpng.html
Summary: Old version of libpng, needed to run old binaries

Topics%20covered

Topics Covered

security advisory update Fedora software fix libpng NULL dereference

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.