Ubuntu 15.10: USN-2815-1 Moderate: libpng Denial Of Service Threats

ubuntu

November 19, 2015

libpng could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

libpng could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- libpng: PNG (Portable Network Graphics) file library

Details:

Mikulas Patocka discovered that libpng incorrectly handled certain large

fields. If a user or automated system using libpng were tricked into

opening a specially crafted image, an attacker could exploit this to cause

libpng to crash, leading to a denial of service. This issue only affected

Ubuntu 12.04 LTS. (CVE-2012-3425)

Qixue Xiao discovered that libpng incorrectly handled certain time values.

If a user or automated system using libpng were tricked into opening a

specially crafted image, an attacker could exploit this to cause libpng to

crash, leading to a denial of service. (CVE-2015-7981)

It was discovered that libpng incorrectly handled certain small bit-depth

values. If a user or automated system using libpng were tricked into

opening a specially crafted image, an at...

Read the Full Advisory

Topics Covered

security advisory denial of service software update access control libpng ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  libpng12-0                      1.2.51-0ubuntu3.15.10.1

Ubuntu 15.04:
  libpng12-0                      1.2.51-0ubuntu3.15.04.1

Ubuntu 14.04 LTS:
  libpng12-0                      1.2.50-1ubuntu2.14.04.1

Ubuntu 12.04 LTS:
  libpng12-0                      1.2.46-3ubuntu4.1

After a standard system update you need to restart your session to make
all the necessary changes.