Security update for libpng12-0 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0061-1 Final 1 1 2016-01-08T14:51:55Z current 2016-01-08T14:51:55Z 2016-01-08T14:51:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libpng12-0 - security update: This update fixes the following securit issue: * CVE-2015-8126 Multiple buffer overflows in the png_set_PLTE and png_get_PLTE functions allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact [bsc#954980] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-libpng12-0-12309,sdksp4-libpng12-0-12309,sledsp3-libpng12-0-12309,sledsp4-libpng12-0-12309,slessp3-libpng12-0-12309,slessp4-libpng12-0-12309 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160061-1/ Link for SUSE-SU-2016:0061-1 https://lists.suse.com/pipermail/sle-security-updates/2016-January/001790.html E-Mail link for SUSE-SU-2016:0061-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/954980 SUSE Bug 954980 https://www.suse.com/security/cve/CVE-2015-8126/ SUSE CVE CVE-2015-8126 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP4 libpng-devel-1.2.31-5.38.1 libpng-devel-32bit-1.2.31-5.38.1 libpng12-0-1.2.31-5.38.1 libpng12-0-32bit-1.2.31-5.38.1 libpng12-0-x86-1.2.31-5.38.1 libpng12-0-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 libpng12-0-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 libpng12-0-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Desktop 11 SP4 libpng12-0-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Desktop 11 SP4 libpng12-0-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP3 libpng12-0-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP3 libpng12-0-x86-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP3 libpng12-0-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libpng12-0-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libpng12-0-x86-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libpng12-0-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP4 libpng12-0-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP4 libpng12-0-x86-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server 11 SP4 libpng12-0-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libpng12-0-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libpng12-0-x86-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libpng12-0-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpng12-0-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpng12-0-x86-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libpng-devel-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 libpng-devel-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 libpng-devel-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libpng-devel-32bit-1.2.31-5.38.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. CVE-2015-8126 SUSE Linux Enterprise Desktop 11 SP3:libpng12-0-1.2.31-5.38.1 SUSE Linux Enterprise Desktop 11 SP3:libpng12-0-32bit-1.2.31-5.38.1 SUSE Linux Enterprise Desktop 11 SP4:libpng12-0-1.2.31-5.38.1 SUSE Linux Enterprise Desktop 11 SP4:libpng12-0-32bit-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libpng12-0-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libpng12-0-32bit-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libpng12-0-x86-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP3:libpng12-0-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP3:libpng12-0-32bit-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP3:libpng12-0-x86-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP4:libpng12-0-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP4:libpng12-0-32bit-1.2.31-5.38.1 SUSE Linux Enterprise Server 11 SP4:libpng12-0-x86-1.2.31-5.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libpng12-0-1.2.31-5.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libpng12-0-32bit-1.2.31-5.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libpng12-0-x86-1.2.31-5.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpng12-0-1.2.31-5.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpng12-0-32bit-1.2.31-5.38.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libpng12-0-x86-1.2.31-5.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libpng-devel-1.2.31-5.38.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libpng-devel-32bit-1.2.31-5.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpng-devel-1.2.31-5.38.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libpng-devel-32bit-1.2.31-5.38.1 moderate 4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160061-1/ https://www.suse.com/security/cve/CVE-2015-8126.html CVE-2015-8126 https://bugzilla.suse.com/954980 SUSE Bug 954980 https://bugzilla.suse.com/958198 SUSE Bug 958198 https://bugzilla.suse.com/960402 SUSE Bug 960402 https://bugzilla.suse.com/962743 SUSE Bug 962743 https://bugzilla.suse.com/963937 SUSE Bug 963937 https://bugzilla.suse.com/969333 SUSE Bug 969333