Test ID:	1.3.6.1.4.1.25623.1.0.59824
Category:	Fedora Local Security Checks
Title:	Fedora Core 7 FEDORA-2007-2666 (libpng)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to libpng announced via advisory FEDORA-2007-2666. The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. PNG is a bit-mapped graphics format similar to the GIF format. PNG was created to replace the GIF format, since GIF uses a patented data compression algorithm. Libpng should be installed if you need to manipulate PNG format image files. ChangeLog: * Thu Oct 18 2007 Tom Lane 2:1.2.22-1 - Update to libpng 1.2.22, primarily to fix CVE-2007-5269 Related: #324771 - Update License tag * Wed May 23 2007 Tom Lane 2:1.2.16-2 - Add patch to fix CVE-2007-2445 Related: #239542 References: [ 1 ] Bug #337461 - CVE-2007-5269 libpng DoS via multiple out-of-bounds reads [F7] https://bugzilla.redhat.com/show_bug.cgi?id=337461 [ 2 ] CVE-2007-5269 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5269 Updated packages: 2cdfd6b92a9fffeefbdce60fcddde452edb75aaf libpng-1.2.22-1.fc7.ppc64.rpm 658fac8d256cd3c97a65f65b3536585a93161ec4 libpng-devel-1.2.22-1.fc7.ppc64.rpm 693a47154913ae78ba8fb267c97d45eda50b2e60 libpng-debuginfo-1.2.22-1.fc7.ppc64.rpm 9803281a0957e1b33e8e36391130aa7367ae1807 libpng-static-1.2.22-1.fc7.ppc64.rpm 80d621b0f0b9f3e43e96d6fa107e6e287e130b62 libpng-devel-1.2.22-1.fc7.i386.rpm 33aaa7092550fb211689f6fc46a383045d0e9788 libpng-debuginfo-1.2.22-1.fc7.i386.rpm f4055c459e1780b71fcb45fd99a6cba06c51635e libpng-1.2.22-1.fc7.i386.rpm eb39a8b5adb4542b712a29e98a9545229f7927ab libpng-static-1.2.22-1.fc7.i386.rpm 8252f38537f6af003eebe5ae08a3a33e218e8754 libpng-debuginfo-1.2.22-1.fc7.x86_64.rpm 10c3d1160d11994d1873fee515cddcc9ba3bc57a libpng-devel-1.2.22-1.fc7.x86_64.rpm b8590897aac036d63855eea510edea2b55bbb9af libpng-static-1.2.22-1.fc7.x86_64.rpm 6410cae8c1acdc1ef04d0688d5a5b8f1bf330a90 libpng-1.2.22-1.fc7.x86_64.rpm 954263fd7565757de7b6dd3448bf49c847052882 libpng-devel-1.2.22-1.fc7.ppc.rpm 3bae37ae9fd4176f84fd06d6736788798f530eec libpng-1.2.22-1.fc7.ppc.rpm a73d283a926db4a7fb95b18e7adda4b0e134bdbd libpng-debuginfo-1.2.22-1.fc7.ppc.rpm 41761795c2fb360b0bb18d41f9707cb56180881c libpng-static-1.2.22-1.fc7.ppc.rpm aecf2aff2f1b8d41b1323362598bb5ee22b196d4 libpng-1.2.22-1.fc7.src.rpm This update can be installed with the yum update program. Use su -c 'yum update libpng' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. Solution: Apply the appropriate updates. http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2007-2666 Risk factor : Medium CVSS Score: 5.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-5269 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://lists.apple.com/archives/security-announce/2008//May/msg00001.html BugTraq ID: 25956 http://www.securityfocus.com/bid/25956 BugTraq ID: 28276 http://www.securityfocus.com/bid/28276 Bugtraq: 20071112 FLEA-2007-0065-1 libpng (Google Search) http://www.securityfocus.com/archive/1/483582/100/0/threaded Bugtraq: 20080304 CORE-2008-0124: Multiple vulnerabilities in Google's Android SDK (Google Search) http://www.securityfocus.com/archive/1/489135/100/0/threaded Bugtraq: 20080318 VMSA-2008-0005 Updated VMware Workstation, VMware Player, VMware Server, VMware ACE, and VMware Fusion resolve critical security issues (Google Search) http://www.securityfocus.com/archive/1/489739/100/0/threaded Bugtraq: 20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues. (Google Search) http://www.securityfocus.com/archive/1/495869/100/0/threaded Cert/CC Advisory: TA08-150A http://www.us-cert.gov/cas/techalerts/TA08-150A.html Debian Security Information: DSA-1750 (Google Search) http://www.debian.org/security/2009/dsa-1750 https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00353.html https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00356.html https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00072.html http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html http://www.gentoo.org/security/en/glsa/glsa-200711-08.xml http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml http://security.gentoo.org/glsa/glsa-201209-25.xml http://www.mandriva.com/security/advisories?name=MDKSA-2007:217 http://www.coresecurity.com/?action=item&id=2148 http://sourceforge.net/mailarchive/forum.php?thread_name=3.0.6.32.20071004082318.012a7628%40mail.comcast.net&forum_name=png-mng-implement http://lists.vmware.com/pipermail/security-announce/2008/000008.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10614 http://www.redhat.com/support/errata/RHSA-2007-0992.html http://www.securitytracker.com/id?1018849 http://secunia.com/advisories/27093 http://secunia.com/advisories/27284 http://secunia.com/advisories/27369 http://secunia.com/advisories/27391 http://secunia.com/advisories/27405 http://secunia.com/advisories/27492 http://secunia.com/advisories/27529 http://secunia.com/advisories/27629 http://secunia.com/advisories/27662 http://secunia.com/advisories/27746 http://secunia.com/advisories/27965 http://secunia.com/advisories/29420 http://secunia.com/advisories/30161 http://secunia.com/advisories/30430 http://secunia.com/advisories/31712 http://secunia.com/advisories/31713 http://secunia.com/advisories/34388 http://secunia.com/advisories/35302 http://secunia.com/advisories/35386 http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.520323 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1 SuSE Security Announcement: SUSE-SR:2007:025 (Google Search) http://www.novell.com/linux/security/advisories/2007_25_sr.html http://www.ubuntu.com/usn/usn-538-1 http://www.vupen.com/english/advisories/2007/3390 http://www.vupen.com/english/advisories/2008/0905/references http://www.vupen.com/english/advisories/2008/0924/references http://www.vupen.com/english/advisories/2008/1697 http://www.vupen.com/english/advisories/2008/2466 http://www.vupen.com/english/advisories/2009/1462 http://www.vupen.com/english/advisories/2009/1560 Common Vulnerability Exposure (CVE) ID: CVE-2007-2445 BugTraq ID: 24000 http://www.securityfocus.com/bid/24000 BugTraq ID: 24023 http://www.securityfocus.com/bid/24023 Bugtraq: 20070517 FLEA-2007-0018-1: libpng (Google Search) http://www.securityfocus.com/archive/1/468910/100/0/threaded CERT/CC vulnerability note: VU#684664 http://www.kb.cert.org/vuls/id/684664 Debian Security Information: DSA-1613 (Google Search) http://www.debian.org/security/2008/dsa-1613 http://www.gentoo.org/security/en/glsa/glsa-200705-24.xml http://www.mandriva.com/security/advisories?name=MDKSA-2007:116 http://openpkg.com/go/OpenPKG-SA-2007.013 http://osvdb.org/36196 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10094 http://www.redhat.com/support/errata/RHSA-2007-0356.html http://www.securitytracker.com/id?1018078 http://secunia.com/advisories/25268 http://secunia.com/advisories/25273 http://secunia.com/advisories/25292 http://secunia.com/advisories/25329 http://secunia.com/advisories/25353 http://secunia.com/advisories/25461 http://secunia.com/advisories/25554 http://secunia.com/advisories/25571 http://secunia.com/advisories/25742 http://secunia.com/advisories/25787 http://secunia.com/advisories/25867 http://secunia.com/advisories/27056 http://secunia.com/advisories/31168 http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.492650 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102987-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200871-1 SuSE Security Announcement: SUSE-SR:2007:013 (Google Search) http://www.novell.com/linux/security/advisories/2007_13_sr.html http://www.trustix.org/errata/2007/0019/ http://www.ubuntu.com/usn/usn-472-1 http://www.vupen.com/english/advisories/2007/1838 http://www.vupen.com/english/advisories/2007/2385 XForce ISS Database: libpng-trns-chunk-dos(34340) https://exchange.xforce.ibmcloud.com/vulnerabilities/34340
Copyright	Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.