CVE-2015-8126: Multiple buffer overflows

[wolf]

Multiple buffer overflows were found in libpng, see https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8126

[Andrew Starr-Bochicchio (andrewsomething)]

For libpng12, it looks like these are the needed commits:

https://github.com/glennrp/libpng/commit/216dbf7f7eef5d999f2e3ba054407917098e9f85
https://github.com/glennrp/libpng/commit/3939689e7d9d06ee05411210bc8e605adcff294e
https://github.com/glennrp/libpng/commit/475bab6170f651b9863e9fc1b8ffd6cd89a45aa0

[Andrew Starr-Bochicchio (andrewsomething)]

Debdiff for xenial incorporating the above upstream commits. Successfully builds in a clean xenial pbuilder.

[Andrew Starr-Bochicchio (andrewsomething)]

debdiff for 15.10 security update

[Andrew Starr-Bochicchio (andrewsomething)]

debdiff for 15.04 security update

[Andrew Starr-Bochicchio (andrewsomething)]

debdiff for 14.04 security update

[Andrew Starr-Bochicchio (andrewsomething)]

All of the above have been test build successfully with pbuilder for their respective releases. There doesn't seem to be any public POC yet...

[Marc Deslauriers (mdeslaur)]

Thanks for the debdiffs, building now for a security update!

[Launchpad Janitor (janitor)]

This bug was fixed in the package libpng - 1.2.50-1ubuntu2.14.04.1

---------------
libpng (1.2.50-1ubuntu2.14.04.1) trusty-security; urgency=medium

  [ Andrew Starr-Bochicchio ]
  * SECURITY UPDATE: Multiple buffer overflows in the (1) png_set_PLTE
    and (2) png_get_PLTE (LP: #1516592).
    - debian/patches/CVE-2015-8126.diff: Prevent writing over-length
      PLTE chunk and silently truncate over-length PLTE chunk while reading.
      Backported from upstream patch.
    - CVE-2015-8126

  [ Marc Deslauriers ]
  * SECURITY UPDATE: out of bounds read in png_set_tIME
    - debian/patches/CVE-2015-7981.patch: check bounds in png.c and
      pngset.c.
    - CVE-2015-7981

 -- Marc Deslauriers <email address hidden> Thu, 19 Nov 2015 08:02:50 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package libpng - 1.2.51-0ubuntu3.15.10.1

---------------
libpng (1.2.51-0ubuntu3.15.10.1) wily-security; urgency=medium

  [ Andrew Starr-Bochicchio ]
  * SECURITY UPDATE: Multiple buffer overflows in the (1) png_set_PLTE
    and (2) png_get_PLTE (LP: #1516592).
    - debian/patches/CVE-2015-8126.diff: Prevent writing over-length
      PLTE chunk and silently truncate over-length PLTE chunk while reading.
      Backported from upstream patch.
    - CVE-2015-8126

  [ Marc Deslauriers ]
  * SECURITY UPDATE: out of bounds read in png_set_tIME
    - debian/patches/CVE-2015-7981.patch: check bounds in png.c and
      pngset.c.
    - CVE-2015-7981

 -- Marc Deslauriers <email address hidden> Thu, 19 Nov 2015 07:56:29 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package libpng - 1.2.51-0ubuntu3.15.04.1

---------------
libpng (1.2.51-0ubuntu3.15.04.1) vivid-security; urgency=medium

  [ Andrew Starr-Bochicchio ]
  * SECURITY UPDATE: Multiple buffer overflows in the (1) png_set_PLTE
    and (2) png_get_PLTE (LP: #1516592).
    - debian/patches/CVE-2015-8126.diff: Prevent writing over-length
      PLTE chunk and silently truncate over-length PLTE chunk while reading.
      Backported from upstream patch.
    - CVE-2015-8126

  [ Marc Deslauriers ]
  * SECURITY UPDATE: out of bounds read in png_set_tIME
    - debian/patches/CVE-2015-7981.patch: check bounds in png.c and
      pngset.c.
    - CVE-2015-7981

 -- Marc Deslauriers <email address hidden> Thu, 19 Nov 2015 07:59:38 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package libpng - 1.2.46-3ubuntu4.1

---------------
libpng (1.2.46-3ubuntu4.1) precise-security; urgency=medium

  [ Andrew Starr-Bochicchio ]
  * SECURITY UPDATE: Multiple buffer overflows in the (1) png_set_PLTE
    and (2) png_get_PLTE (LP: #1516592).
    - debian/patches/CVE-2015-8126.diff: Prevent writing over-length
      PLTE chunk and silently truncate over-length PLTE chunk while reading.
      Backported from upstream patch.
    - CVE-2015-8126

  [ Marc Deslauriers ]
  * SECURITY UPDATE: out of bounds read in png_set_tIME
    - debian/patches/CVE-2015-7981.patch: check bounds in png.c and
      pngset.c.
    - CVE-2015-7981
  * SECURITY UPDATE: out of bounds read in png_push_read_zTXt
    - debian/patches/CVE-2012-3425.patch: check for truncated chunk in
      pngpread.c.
    - CVE-2012-3425

 -- Marc Deslauriers <email address hidden> Thu, 19 Nov 2015 08:05:59 -0500

[Andrew Starr-Bochicchio (andrewsomething)]

Thanks Marc!