Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowarbitrary code execution

Fedora 26 OptiPNG Security Advisory: CVE-2017-1000229 & CVE-2017-16938

Security fix for CVE-2017-1000229 and CVE-2017-16938. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-018464cbf9 2017-12-19 19:57:44.408874 --------------------------------------------------------------------------------Name : optipng Product : Fedora 26 Version : 0.7.6 Release : 6.fc26 URL : Summary : PNG optimizer and converter Description : OptiPNG is a PNG optimizer that recompresses image files to a smaller size, without losing any information. This program also converts external formats (BMP, GIF, PNM and TIFF) to optimized PNG, and performs PNG integrity checks and corrections. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2017-1000229 and CVE-2017-16938 --------------------------------------------------------------------------------References: [ 1 ] Bug #1520234 - CVE-2017-1000229 optipng: integer overflow in tiffread.c:minitiff_read_info() allows for arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=1520234 [ 2 ] Bug #1520227 - CVE-2017-16938 optipng: global buffer overflow in gifread.c:LZWReadByte when parsing malicious GIF https://bugzilla.redhat.com/show_bug.cgi?id=1520227 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade optipng' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. Tounsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. . Ensure you download the most recent security patch for Fedora 26's optipng which resolves serious vulnerabilities identified as CVE-2017-1000229 and CVE-2017-16938.. Fedora Update, OptiPNG Security Fix, Image Optimization. . Severity: Critical. LinuxSecurity.com Team

Dec 19, 2017 •Critical Fedora