-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:217
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : libpng
 Date    : November 13, 2007
 Affected: 2007.0, 2007.1, 2008.0, Corporate 3.0, Corporate 4.0,
           Multi Network Firewall 2.0
 _______________________________________________________________________
 
 Problem Description:
 
 Multiple vulnerabilities were discovered in libpng:
 
 An off-by-one error when handling ICC profile chunks in the
 png_set_iCCP() function (CVE-2007-5266; only affects Mandriva Linux
 2008.0).
 
 George Cook and Jeff Phillips reported several errors in pngrtran.c,
 such as the use of logical instead of bitwise functions and incorrect
 comparisons (CVE-2007-5268; only affects Mandriva Linux 2008.0).
 
 Tavis Ormandy reported out-of-bounds read errors in several PNG chunk
 handling functions (CVE-2007-5269).
 
 Updated packages have been patched to correct these issues.
 For Mandriva Linux 2008.0, libpng 1.2.22 is being provided which
 corrects all three issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5266
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5268
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5269
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 6e6a1a752c3323210b7873d9050cc2d1  2007.0/i586/libpng3-1.2.12-2.4mdv2007.0.i586.rpm
 44c4d399df519a3774a470cf819fb396  2007.0/i586/libpng3-devel-1.2.12-2.4mdv2007.0.i586.rpm
 a1933a55e7ee2fc3a250c6c429dfce93  2007.0/i586/libpng3-static-devel-1.2.12-2.4mdv2007.0.i586.rpm 
 4a1f620d405d0bc92c24912f5d109726  2007.0/SRPMS/libpng-1.2.12-2.4mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 d367cc02889fa90498a8d0daa03cb89b  2007.0/x86_64/lib64png3-1.2.12-2.4mdv2007.0.x86_64.rpm
 17216e150ba6841c0f1101f2f254a26b  2007.0/x86_64/lib64png3-devel-1.2.12-2.4mdv2007.0.x86_64.rpm
 890f7e25640ed0d140304bd84e05a8f4  2007.0/x86_64/lib64png3-static-devel-1.2.12-2.4mdv2007.0.x86_64.rpm 
 4a1f620d405d0bc92c24912f5d109726  2007.0/SRPMS/libpng-1.2.12-2.4mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 6a9c7d8f81e83eb36247ff0490a6e282  2007.1/i586/libpng3-1.2.13-2.2mdv2007.1.i586.rpm
 1f78dea1216514f421f406672ddbc27e  2007.1/i586/libpng3-devel-1.2.13-2.2mdv2007.1.i586.rpm
 49d4946c5b4555a757472dc2267ab7ca  2007.1/i586/libpng3-static-devel-1.2.13-2.2mdv2007.1.i586.rpm 
 bd23b5b93b5f4e196c098d451ba61740  2007.1/SRPMS/libpng-1.2.13-2.2mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 eaa4631b4186ecfa64f7d5e5618e8ed6  2007.1/x86_64/lib64png3-1.2.13-2.2mdv2007.1.x86_64.rpm
 a7ea7e725848d8f9b2064b5c8f6af2a4  2007.1/x86_64/lib64png3-devel-1.2.13-2.2mdv2007.1.x86_64.rpm
 0886fd8b11d64a9104b145bd6a80dabd  2007.1/x86_64/lib64png3-static-devel-1.2.13-2.2mdv2007.1.x86_64.rpm 
 bd23b5b93b5f4e196c098d451ba61740  2007.1/SRPMS/libpng-1.2.13-2.2mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 60aeee7c6232797cbb019b847354a1ee  2008.0/i586/libpng-devel-1.2.22-0.1mdv2008.0.i586.rpm
 945c51dca471b3e85417fd98ee75d6a5  2008.0/i586/libpng-source-1.2.22-0.1mdv2008.0.i586.rpm
 d4a9f587e93f29844db3ffbb8e2ad5c8  2008.0/i586/libpng-static-devel-1.2.22-0.1mdv2008.0.i586.rpm
 5971dd0615c2c41e1e8501e24b80fc35  2008.0/i586/libpng3-1.2.22-0.1mdv2008.0.i586.rpm 
 57077fbd7202ada302d435df35eb0b3f  2008.0/SRPMS/libpng-1.2.22-0.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 9ec7f1e81514c27a0c3e818157cb9ac9  2008.0/x86_64/lib64png-devel-1.2.22-0.1mdv2008.0.x86_64.rpm
 f5db16ab9f528476d1ce5835a5686af1  2008.0/x86_64/lib64png-static-devel-1.2.22-0.1mdv2008.0.x86_64.rpm
 989081716cb746497bcde8b846c7cae7  2008.0/x86_64/lib64png3-1.2.22-0.1mdv2008.0.x86_64.rpm
 31a6c01ff31fec291b6906852d0e8b29  2008.0/x86_64/libpng-source-1.2.22-0.1mdv2008.0.x86_64.rpm 
 57077fbd7202ada302d435df35eb0b3f  2008.0/SRPMS/libpng-1.2.22-0.1mdv2008.0.src.rpm

 Corporate 3.0:
 0e5f7e4d91eb46712cdfaff8abf8bd9f  corporate/3.0/i586/libpng3-1.2.5-10.9.C30mdk.i586.rpm
 3a90decd4088b6a49691c147d65bb7b0  corporate/3.0/i586/libpng3-devel-1.2.5-10.9.C30mdk.i586.rpm
 bba0383eecdebceffbfbba57db77af78  corporate/3.0/i586/libpng3-static-devel-1.2.5-10.9.C30mdk.i586.rpm 
 3c2af2ec7c62f0cab6175036b96645de  corporate/3.0/SRPMS/libpng-1.2.5-10.9.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 825654d8659640d47bd35f31ece3d34c  corporate/3.0/x86_64/lib64png3-1.2.5-10.9.C30mdk.x86_64.rpm
 e016ff95747174902fc7008ea87daa6e  corporate/3.0/x86_64/lib64png3-devel-1.2.5-10.9.C30mdk.x86_64.rpm
 eb52ed562b56248b3fc1c1b52f333d30  corporate/3.0/x86_64/lib64png3-static-devel-1.2.5-10.9.C30mdk.x86_64.rpm
 0e5f7e4d91eb46712cdfaff8abf8bd9f  corporate/3.0/x86_64/libpng3-1.2.5-10.9.C30mdk.i586.rpm 
 3c2af2ec7c62f0cab6175036b96645de  corporate/3.0/SRPMS/libpng-1.2.5-10.9.C30mdk.src.rpm

 Corporate 4.0:
 c57f8cee626aec43891cd5040f1eb5bf  corporate/4.0/i586/libpng3-1.2.8-1.4.20060mlcs4.i586.rpm
 bfa61e1aee1360dc57518d0bd8c6a12a  corporate/4.0/i586/libpng3-devel-1.2.8-1.4.20060mlcs4.i586.rpm
 597398c4eae476728ba746432c4edb61  corporate/4.0/i586/libpng3-static-devel-1.2.8-1.4.20060mlcs4.i586.rpm 
 5163d8dec7610e578e043c6b429cceff  corporate/4.0/SRPMS/libpng-1.2.8-1.4.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 ae34926bcf70c445c63845b985cbbb2a  corporate/4.0/x86_64/lib64png3-1.2.8-1.4.20060mlcs4.x86_64.rpm
 9c3e1e0c7e38036e8068ac36d02bd83d  corporate/4.0/x86_64/lib64png3-devel-1.2.8-1.4.20060mlcs4.x86_64.rpm
 36058d8c1363e7d6b4887adefbe153a0  corporate/4.0/x86_64/lib64png3-static-devel-1.2.8-1.4.20060mlcs4.x86_64.rpm
 c57f8cee626aec43891cd5040f1eb5bf  corporate/4.0/x86_64/libpng3-1.2.8-1.4.20060mlcs4.i586.rpm
 bfa61e1aee1360dc57518d0bd8c6a12a  corporate/4.0/x86_64/libpng3-devel-1.2.8-1.4.20060mlcs4.i586.rpm 
 5163d8dec7610e578e043c6b429cceff  corporate/4.0/SRPMS/libpng-1.2.8-1.4.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 2764fc9a199ef409305d093911908f6c  mnf/2.0/i586/libpng3-1.2.5-10.9.M20mdk.i586.rpm
 6f3d649546be0b347432bdeef1f6557f  mnf/2.0/i586/libpng3-devel-1.2.5-10.9.M20mdk.i586.rpm
 6d016e9b217a4de53fc86cb4f898aed1  mnf/2.0/i586/libpng3-static-devel-1.2.5-10.9.M20mdk.i586.rpm 
 1048fae70e7fecfceef6bbb9b9abbc2e  mnf/2.0/SRPMS/libpng-1.2.5-10.9.M20mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFHOeKjmqjQ0CJFipgRAj/oAJ9w3NetJ8y+NROVS2klcK5zo5beqwCcDNHp
+xeCbTJ/6P8VRBtN4NbfOJI=
=dbf3
-----END PGP SIGNATURE-----