| Description: | Description:
The remote host is missing an update to libpng10
announced via advisory FEDORA-2010-10833.
The libpng10 package contains an old version of libpng, a library of functions
for creating and manipulating PNG (Portable Network Graphics) image format
files.
Update Information:
This update addresses two security issues:
* CVE-2010-1205, in which a buffer overflow might allow remote attackers to
execute arbitrary code via a PNG image that triggers an additional data row.
* CVE-2010-2249, in which a memory leak allows remote attackers to cause a
denial of service (memory consumption and application crash) via a PNG image
containing malformed Physical Scale (aka sCAL) chunks.
References:
[ 1 ] Bug #608238 - CVE-2010-1205 libpng: out-of-bounds memory write
https://bugzilla.redhat.com/show_bug.cgi?id=608238
[ 2 ] Bug #608644 - CVE-2010-2249 libpng: Memory leak when processing Physical Scale (sCAL) images
https://bugzilla.redhat.com/show_bug.cgi?id=608644
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update libpng10' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2010-10833
Risk factor : High
CVSS Score:
7.8
|
