Quantcast

Maximum PC

It is currently Sun Nov 23, 2014 9:37 am

All times are UTC - 8 hours




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: [slackware-security] libpng (SSA:2004-222-01)
PostPosted: Tue Aug 10, 2004 4:19 am 
Forum's 3dfx Zealot
Forum's 3dfx Zealot

Joined: Thu Jun 24, 2004 1:21 pm
Posts: 251
Location: Florida
New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0,
and -current to fix security issues. These issues could cause program crashes,
or possibly allow arbitrary code embedded in a malicious PNG image to execute.
The PNG library is widely used within the system, so all sites should upgrade
to the new libpng package.

More details about these issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2004-0597
http://cve.mitre.org/cgi-bin/cvename.cg ... -2004-0598
http://cve.mitre.org/cgi-bin/cvename.cg ... -2004-0599

Here are the details from the Slackware 10.0 ChangeLog:
+--------------------------+
Sat Aug 7 17:17:20 PDT 2004
patches/packages/libpng-1.2.5-i486-3.tgz: Patched possible security
issues including buffer and integer overflows and null pointer
references. These issues could cause program crashes, or possibly
allow arbitrary code embedded in a malicious PNG image to execute.
The PNG library is widely used within the system, so all sites
should upgrade to the new libpng package.
For more details, see:
http://cve.mitre.org/cgi-bin/cvename.cg ... -2004-0597
http://cve.mitre.org/cgi-bin/cvename.cg ... -2004-0598
http://cve.mitre.org/cgi-bin/cvename.cg ... -2004-0599
(* Security fix *)
+--------------------------+

Where to find the new packages:
+-----------------------------+

Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/s ... i386-1.tgz

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/s ... i386-2.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/s ... i486-3.tgz

Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/s ... i486-3.tgz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/s ... i486-3.tgz

MD5 signatures:
+-------------+

Slackware 8.1 package:
be08f3ea7e8b41a3fd7ce49a676617e0 libpng-1.2.5-i386-1.tgz

Slackware 9.0 package:
6c68e6a65850e26b60651d65fd8c0a2f libpng-1.2.5-i386-2.tgz

Slackware 9.1 package:
4fcf53708102839f3cac78a99d05e750 libpng-1.2.5-i486-3.tgz

Slackware 10.0 package:
094a9825c51204a9aa2cb0bbb43b7a64 libpng-1.2.5-i486-3.tgz

Slackware -current package:
094a9825c51204a9aa2cb0bbb43b7a64 libpng-1.2.5-i486-3.tgz

Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg libpng-1.2.5-i486-3.tgz

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com


Top
  Profile  
 
 Post subject:
PostPosted: Thu Sep 02, 2004 1:27 am 
Boy in Black
Boy in Black
User avatar

Joined: Thu Jun 24, 2004 1:40 pm
Posts: 24345
Location: South of heaven
Slackware sucks...


Top
  Profile  
 
 Post subject:
PostPosted: Thu Oct 07, 2004 6:30 am 
Forum's 3dfx Zealot
Forum's 3dfx Zealot

Joined: Thu Jun 24, 2004 1:21 pm
Posts: 251
Location: Florida
Yeah chumly that is the best reason so far i ever seen for switching from slackware.


You just keep on trolling.


Top
  Profile  
 
 Post subject:
PostPosted: Thu Oct 07, 2004 9:25 am 
Java Junkie
Java Junkie
User avatar

Joined: Mon Jun 14, 2004 10:23 am
Posts: 24236
Location: Granite Heaven
Thanks for the info, Jawa.

Chumly ... be nice, or you'll find a post in FA about you. :P


Top
  Profile  
 
 Post subject:
PostPosted: Thu Oct 07, 2004 10:41 am 
Forum's 3dfx Zealot
Forum's 3dfx Zealot

Joined: Thu Jun 24, 2004 1:21 pm
Posts: 251
Location: Florida
Jipstyle.

I had posted that quite a while ago. and I stupid locked my self out of the forums a while ago and just got tried enough to ask chams to reset my account email addy. So i am going throug and i saw chumly here posting to the libpng fix .... which the only reason why it was there was because of the whole libpng bug that affected every os that use libpng.

But like i said it was the most convincing reason to switch yet.


Top
  Profile  
 
 Post subject:
PostPosted: Thu Oct 07, 2004 9:12 pm 
Java Junkie
Java Junkie
User avatar

Joined: Mon Jun 14, 2004 10:23 am
Posts: 24236
Location: Granite Heaven
Yeah ... I just realised that the first three posts each came a month apart.

:?

Let's just let this thread die gracefully.

/me backs away, whistling softly.


Top
  Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 8 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group

© 2014 Future US, Inc. All rights reserved.