Multiple vulnerabilities were found in libpng, which might result in the execution of arbitrary code
|Package||media-libs/libpng on all architectures|
|Affected versions||< 1.2.35|
|Unaffected versions||>= 1.2.35|
libpng is the official PNG reference library used to read, write and manipulate PNG images.
Multiple vulnerabilities were discovered in libpng:
A remote attacker may execute arbitrary code with the privileges of the user opening a specially crafted PNG file by exploiting the erroneous out-of-memory handling. An attacker may also exploit the png_check_keyword() error to set arbitrary memory locations to 0, if the application allows overlong, user-controlled keywords when writing PNG files. The png_handle_tEXT() vulnerability may be exploited by an attacker to potentially consume all memory on a users system when a specially crafted PNG file is opened.
There is no known workaround at this time.
All libpng users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libpng-1.2.35"