Test ID:	1.3.6.1.4.1.25623.1.0.69952
Category:	Fedora Local Security Checks
Title:	Fedora Core 15 FEDORA-2011-8844 (libpng10)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to libpng10 announced via advisory FEDORA-2011-8844. Update Information: This update fixes a 1-byte uninitialized memory reference in png_format_buffer(). It allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. This is CVE-2011-2501. Also fixed in this release are some other minor security problems and there's additionally a bugfix backported from 1.5.3: when expanding a paletted image, always expand to RGBA if transparency is present. References: [ 1 ] Bug #717084 - CVE-2011-2501 libpng: regression of CVE-2004-0421 in 1.2.23+ https://bugzilla.redhat.com/show_bug.cgi?id=717084 [ 2 ] Bug #720607 - CVE-2011-2690 libpng: buffer overwrite in png_rgb_to_gray https://bugzilla.redhat.com/show_bug.cgi?id=720607 [ 3 ] Bug #720612 - CVE-2011-2692 libpng: Memory corruption when handling empty sCAL chunks https://bugzilla.redhat.com/show_bug.cgi?id=720612 [ 4 ] Bug #720608 - CVE-2011-2691 libpng: Crash in png_default_error due to use of NULL Pointer https://bugzilla.redhat.com/show_bug.cgi?id=720608 Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update libpng10' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2011-8844 Risk factor : High CVSS Score: 6.8
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-2501 BugTraq ID: 48474 http://www.securityfocus.com/bid/48474 Debian Security Information: DSA-2287 (Google Search) http://www.debian.org/security/2011/dsa-2287 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062720.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.html http://security.gentoo.org/glsa/glsa-201206-15.xml http://www.mandriva.com/security/advisories?name=MDVSA-2011:151 http://www.openwall.com/lists/oss-security/2011/06/27/13 http://www.openwall.com/lists/oss-security/2011/06/28/16 http://www.redhat.com/support/errata/RHSA-2011-1105.html http://secunia.com/advisories/45046 http://secunia.com/advisories/45289 http://secunia.com/advisories/45405 http://secunia.com/advisories/45415 http://secunia.com/advisories/45460 http://secunia.com/advisories/45486 http://secunia.com/advisories/45492 http://secunia.com/advisories/49660 http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.617466 http://www.ubuntu.com/usn/USN-1175-1 XForce ISS Database: libpng-pngerror-dos(68517) https://exchange.xforce.ibmcloud.com/vulnerabilities/68517 Common Vulnerability Exposure (CVE) ID: CVE-2004-0421 http://lists.apple.com/mhonarc/security-announce/msg00056.html BugTraq ID: 10244 http://www.securityfocus.com/bid/10244 Bugtraq: 20040429 [OpenPKG-SA-2004.017] OpenPKG Security Advisory (png) (Google Search) http://marc.info/?l=bugtraq&m=108334922320309&w=2 Debian Security Information: DSA-498 (Google Search) http://www.debian.org/security/2004/dsa-498 http://marc.info/?l=fedora-announce-list&m=108451350029261&w=2 http://marc.info/?l=fedora-announce-list&m=108451353608968&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2004:040 http://www.mandriva.com/security/advisories?name=MDKSA-2006:212 http://www.mandriva.com/security/advisories?name=MDKSA-2006:213 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11710 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A971 http://www.redhat.com/support/errata/RHSA-2004-180.html http://www.redhat.com/support/errata/RHSA-2004-181.html http://secunia.com/advisories/22957 http://secunia.com/advisories/22958 http://marc.info/?l=bugtraq&m=108335030208523&w=2 XForce ISS Database: libpng-png-dos(16022) https://exchange.xforce.ibmcloud.com/vulnerabilities/16022 Common Vulnerability Exposure (CVE) ID: CVE-2011-2690 45046 45405 45415 45460 45461 http://secunia.com/advisories/45461 45492 48660 http://www.securityfocus.com/bid/48660 49660 APPLE-SA-2011-10-12-3 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html DSA-2287 FEDORA-2011-9336 GLSA-201206-15 MDVSA-2011:151 RHSA-2011:1104 http://www.redhat.com/support/errata/RHSA-2011-1104.html RHSA-2011:1105 USN-1175-1 [oss-security] 20110713 Security issues fixed in libpng 1.5.4 http://www.openwall.com/lists/oss-security/2011/07/13/2 http://support.apple.com/kb/HT5002 http://www.libpng.org/pub/png/libpng.html https://bugzilla.redhat.com/show_bug.cgi?id=720607 libpng-pngrgbtogray-bo(68538) https://exchange.xforce.ibmcloud.com/vulnerabilities/68538 Common Vulnerability Exposure (CVE) ID: CVE-2011-2692 45445 http://secunia.com/advisories/45445 48618 http://www.securityfocus.com/bid/48618 APPLE-SA-2012-05-09-1 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html RHSA-2011:1103 http://www.redhat.com/support/errata/RHSA-2011-1103.html VU#819894 http://www.kb.cert.org/vuls/id/819894 http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=61a2d8a2a7b03023e63eae9a3e64607aaaa6d339 http://sourceforge.net/mailarchive/forum.php?thread_name=003101cc2790%24fb5d6e80%24f2184b80%24%40acm.org&forum_name=png-mng-implement http://support.apple.com/kb/HT5281 https://bugzilla.redhat.com/show_bug.cgi?id=720612 libpng-png-file-dos(68536) https://exchange.xforce.ibmcloud.com/vulnerabilities/68536 Common Vulnerability Exposure (CVE) ID: CVE-2011-2691 HPSBMU02776 http://marc.info/?l=bugtraq&m=133951357207000&w=2 SSRT100852 http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=9dad5e37aef295b4ef8dea39392b652deebc9261 https://bugzilla.redhat.com/show_bug.cgi?id=720608 libpng-pngdefaulterror-dos(68537) https://exchange.xforce.ibmcloud.com/vulnerabilities/68537
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.