A buffer overflow has been found in the libpng library that could lead to the execution of arbitrary code.
|Package||media-libs/libpng on all architectures|
|Affected versions||< 1.2.12|
|Unaffected versions||>= 1.2.12|
|Package||app-emulation/emul-linux-x86-baselibs on the amd64 architecture|
|Affected versions||< 2.5.1|
|Unaffected versions||>= 2.5.1|
libpng is an open, extensible image format library, with lossless compression.
In pngrutil.c, the function png_decompress_chunk() allocates insufficient space for an error message, potentially overwriting stack data, leading to a buffer overflow.
By enticing a user to load a maliciously crafted PNG image, an attacker could execute arbitrary code with the rights of the user, or crash the application using the libpng library, such as the emul-linux-x86-baselibs.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.12"
All AMD64 emul-linux-x86-baselibs users should also upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/emul-linux-x86-baselibs-2.5.1"