Affected: Alpaquita:23: libpng, Alpaquita:25: libpng, Alpaquita:stream: libpng, BellSoft Hardened Containers:23: libpng, BellSoft Hardened Containers:25: libpng, BellSoft Hardened Containers:stream: libpng

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Affected: openEuler:24.03-LTS: libpng

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fix(es):

['Hello, everyone,\n\nThis is an out-of-band notice. Unlike previous libpng announcements,\nthis one doesn\'t coincide with a libpng release, and the disclosure\ncadence differs from the usual coordinated pattern:\n\n- The fix landed on the libpng18 development branch (commit\n faf0692468) approximately one month before this announcement.\n libpng 1.8.0 is in late beta with no tagged release yet, so\n there is no upstream release version with which to align the\n disclosure. Downstream consumers building directly from the\n libpng18 branch have had the fix available since it landed.\n- The vulnerable code originates in the third-party libpng-apng\n patch, which is not under upstream libpng control. The patch\n is applied downstream by Firefox and Thunderbird, as well as\n several Linux distributions (Gentoo and LFS/BLFS among others).\n The libpng-apng maintainer, Daisuke Nishikawa, has since released\n fixed revisions (libpng-1.6.57-apng.patch v2 and\n libpng-1.6.58-apng.patch); downstream consumers should either\n update to those (verifying that both upstream commits are\n included), or backport the upstream commits themselves (see\n "Related fix" below).\n\n=== CVE-20…

libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling

Affected: Ubuntu:Pro:20.04:LTS: libpng1.6, Ubuntu:22.04:LTS: libpng1.6

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libpng ausnutzen, um einen Denial of Service Angriff durchzuführen.