USN-5432-2: libpng vulnerabilities
24 May 2022
Several security issues were fixed in libpng.
Releases
Packages
- libpng1.6 - PNG (Portable Network Graphics) file library
Details
USN-5432-1 fixed vulnerabilities in libpng.
This update provides the corresponding updates for libpng1.6.
Original advisory details:
It was discovered that libpng incorrectly handled memory when parsing
certain PNG files. If a user or automated system were tricked into opening
a specially crafted PNG file, an attacker could use this issue to cause
libpng to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2017-12652)
Zhengxiong Luo discovered that libpng incorrectly handled memory when parsing
certain PNG files. If a user or automated system were tricked into opening
a specially crafted PNG file, an attacker could use this issue to cause
libpng to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2018-14048)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
libpng16-dev
-
1.6.20-2ubuntu0.1~esm1
Available with Ubuntu Pro
-
libpng16-16
-
1.6.20-2ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5432-1: libpng3, libpng12-dev, libpng, libpng12-0