Petr Gajdos changed bug 1202662
What Removed Added
Assignee pgajdos@suse.com security-team@suse.de

Comment # 2 on bug 1202662 from
 * 20201113 BB:  fixed buffer-overflow vulnerability discovered by "giantbranch
 *               of NSFOCUS Security Team"
 *               https://bugzilla.redhat.com/show_bug.cgi?id=1897485
 * 20201128 BB:  found and fixed four additional vulnerabilities (null-pointer
 *               dereference and three buffer overruns)
 * 20201209 LP:  fixed an off-by-one bug in check_magic() (Lucy Phipps)
 * 20201209 LL:  converted two zlib-version warnings/errors to go to stderr
 *               (Lemures Lemniscati, actually from 20180318; forwarded by LP)
 * 20201210 BB:  fixed another buffer-overflow vulnerability discovered by
 *               "giantbranch of NSFOCUS Security Team"
 *               https://bugzilla.redhat.com/show_bug.cgi?id=1905775
 * 20201212 GRR: removed -f ("force") option due to multiple security issues
 * 20201212 GRR: released version 3.0.0
 *               ----------------------

I propose to update the pngcheck in backports to 3.0.3. In B15sp4 for sure (see
http://www.libpng.org/pub/png/apps/pngcheck.html) and preferably also in
B15sp3, even if -f option removed in 3.0.0.

Packages submitted for B15sp4,B15sp3/pngcheck.

I believe all fixed.


You are receiving this mail because: