Opened 8 years ago

Closed 6 years ago

Last modified 6 years ago

#3977 closed defect (fixed)

update libpng 1.6.19 to 1.6.21 due to security

Reported by: Raymond Owned by:
Priority: Must Have Milestone: Alpha 20
Component: Core engine Keywords:
Cc: Patch:

Description (last modified by Satoral)

see:

http://www.libpng.org/pub/png/libpng.html :

"Virtually all libpng versions through 1.6.19, 1.5.24, 1.4.17, 1.2.54, and 1.0.64, respectively, have a potential pointer overflow/underflow in png_handle_sPLT()/png_handle_pCAL() (and in png_handle_iTXt()/png_handle_zTXt() in the pre-1.6 branches), and all such versions likewise have a bug in their png_set_PLTE() implementations that left it open to the out-of-bounds write (CVE-2015-8126) that was supposed to have been fixed in the previous release. The bugs are fixed in versions 1.6.20, 1.5.25, 1.4.18, 1.2.55, and 1.0.65, released on 3 December 2015."

Change History (3)

comment:1 by Raymond, 8 years ago

...for using zlib

comment:2 by Satoral, 6 years ago

Description: modified (diff)
Milestone: BacklogAlpha 23
Resolution: fixed
Status: newclosed

In r17680:

Updates precompiled win32 libpng to 1.6.21, built with VC++ 2013 (v120_xp toolset), refs #3004.

comment:3 by Stan, 6 years ago

Milestone: Alpha 23Alpha 20

Thanks for noticing this had been fixed. I'm putting that in the correct milestone though.

Note: See TracTickets for help on using tickets.