My favorites ▼ | Sign in
Project Home Downloads Wiki Issues Code Search
New issue   Search
for
  Advanced search   Search tips   Subscriptions
Issue 47633: Update libpng to 1.2.44
1 person starred this issue and may be notified of changes. Back to list
Status:  Fixed
Owner:  mhm@chromium.org
Closed:  Dec 2012
Cc:  mhm@chromium.org, a...@chromium.org, phajdan.jr@chromium.org, chromium.cdn@gmail.com

Restricted
  • Only users with Commit permission may comment.


Sign in to add a comment
 
Project Member Reported by mhm@chromium.org, Jun 26, 2010 
According to a developer on irc:


11:39 < gnpbil> there's a new version of libpng out, it fixes a security
                vulnerability
11:39 < gnpbil> http://www.libpng.org/pub/png/libpng.html
11:40 < gnpbil> "the possibility of execution of an attacker's code with the
                privileges of the libpng user (including remote compromise in
                the case of a libpng-based browser visiting a hostile web site)"

We would need to update libpng from 1.2.42 to 1.2.43

Is there any reason why we wont use the 1.4.x series?
Jun 26, 2010
#1 mhm@chromium.org 
Typo, should be from 1.2.43 to 1.2.44
Summary: Update libpng to 1.2.44
Jun 26, 2010
#2 mhm@chromium.org 
(No comment was entered for this change.)
Labels: -Area-Undefined SecSeverity-High
Jun 26, 2010
#3 phajdan.jr@chromium.org 
Just making sure it's on the security team's radar.
Owner: secur...@chromium.org
Cc: phajdan...@chromium.org
Labels: Restrict-View-SecurityTeam
Jun 26, 2010
#4 mhm@chromium.org 
I am updating it now, based on the attached file.

According to the security advisory on their website:
http://www.libpng.org/pub/png/libpng.html

Several versions of libpng through 1.4.2 (and through 1.2.43 in the older series) contain a bug whereby progressive applications such as web browsers (or the rpng2 demo app included in libpng) could receive an extra row of image data beyond the height reported in the header, potentially leading to an out-of-bounds write to memory (depending on how the application is written) and the possibility of execution of an attacker's code with the privileges of the libpng user (including remote compromise in the case of a libpng-based browser visiting a hostile web site). This vulnerability has been assigned ID CVE-2010-1205 (via Mozilla).
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1205

An additional memory-leak bug, involving images with malformed sCAL chunks, is also present; it could lead to an application crash (denial of service) when viewing such images.
Status: Started
Owner: m...@chromium.org
Cc: secur...@chromium.org
Jun 26, 2010
#5 mhm@chromium.org 
(No comment was entered for this change.)
libpng-1.2.44-1.2.43-diff.patch
20.8 KB   View   Download
Jun 26, 2010
#6 scarybea...@gmail.com 
For v5 stable, we will be using a WebKit workaround patch that checks the range of the returned row.
But, good to get a fully uptodate libpng on trunk, thanks guys!
Jun 26, 2010
#8 infe...@chromium.org 
we will check with laforge@ to see if this needs to be merged to 375. also, cris did fix this in webkit glue code, so, i think we might just merge that one for 375.
Status: WillMerge
Cc: -secur...@chromium.org c...@chromium.org
Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Jun 26, 2010
#9 jschuh@chromium.org 
Yeah, the other half of this patch is in  issue 45983 , and will cover distros that haven't had a chance to update libpng.
Jul 2, 2010
#11 infe...@chromium.org 
(No comment was entered for this change.)
Status: FixUnreleased
Oct 12, 2012
#12 bugdroid1@chromium.org 
This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.
Labels: Restrict-AddIssueComment-Commit
Dec 20, 2012
#13 jschuh@chromium.org 
(No comment was entered for this change.)
Status: Fixed
Mar 11, 2013
#14 bugdroid1@chromium.org 
(No comment was entered for this change.)
Labels: -SecSeverity-High Security-Severity-High
Mar 13, 2013
#15 bugdroid1@chromium.org 
(No comment was entered for this change.)
Labels: Restrict-View-EditIssue
Mar 21, 2013
#16 scarybea...@gmail.com 
(No comment was entered for this change.)
Labels: -Restrict-View-SecurityNotify -Restrict-View-EditIssue
Mar 21, 2013
#17 bugdroid1@chromium.org 
(No comment was entered for this change.)
Labels: -Security-Severity-High Security_Severity-High
► Sign in to add a comment

Powered by Google Project Hosting