Ubuntu 20.04: USN-4509-2 Important: OpenSSL Security Vulnerability

ubuntu

July 26, 2011

Libpng could be made to run programs as your login if it opened a specially crafted file.

Summary

Libpng could be made to run programs as your login if it opened a

specially crafted file.

Software Description:

- libpng: PNG (Portable Network Graphics) file library

Details:

Frank Busse discovered that libpng did not properly handle certain

malformed PNG images. If a user or automated system were tricked into

opening a crafted PNG file, an attacker could cause libpng to crash,

resulting in a denial of service. This issue only affected Ubuntu

10.04 LTS, 10.10, and 11.04. (CVE-2011-2501)

It was discovered that libpng did not properly handle certain malformed PNG

images. If a user or automated system were tricked into opening a crafted

PNG file, an attacker could cause a denial of service or possibly execute

arbitrary code with the privileges of the user invoking the program.

(CVE-2011-2690)

Frank Busse discovered that libpng did not properly handle certain PNG

images with invalid sCAL chunks. If a user or automated system were tricked

into opening a craf...

Read the Full Advisory

Topics Covered

security advisory denial of service code execution libpng ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  libpng12-0                      1.2.44-1ubuntu3.1

Ubuntu 10.10:
  libpng12-0                      1.2.44-1ubuntu0.1

Ubuntu 10.04 LTS:
  libpng12-0                      1.2.42-1ubuntu2.2

Ubuntu 8.04 LTS:
  libpng12-0                      1.2.15~beta5-3ubuntu0.4

After a standard system update you need to reboot your computer to make
all the necessary changes.