USN-5432-1: libpng vulnerabilities
23 May 2022
Several security issues were fixed in libpng.
Releases
Packages
- libpng - PNG (Portable Network Graphics) file library
Details
It was discovered that libpng incorrectly handled memory when parsing
certain PNG files. If a user or automated system were tricked into opening
a specially crafted PNG file, an attacker could use this issue to cause
libpng to crash, resulting in a denial of service, or possible execute
arbitrary code. (CVE-2017-12652)
Zhengxiong Luo discovered that libpng incorrectly handled memory when parsing
certain PNG files. If a user or automated system were tricked into opening
a specially crafted PNG file, an attacker could use this issue to cause
libpng to crash, resulting in a denial of service, or possible execute
arbitrary code. (CVE-2018-14048)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
libpng12-0
-
1.2.54-1ubuntu1.1+esm1
Available with Ubuntu Pro
-
libpng12-dev
-
1.2.54-1ubuntu1.1+esm1
Available with Ubuntu Pro
-
libpng3
-
1.2.54-1ubuntu1.1+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5432-2: libpng16-16, libpng16-dev, libpng1.6