[Secure-testing-team] Bug#805113: CVE-2015-8126: buffer overflow

[Josh Triplett]

Package: libpng12-0
Version: 1.2.50-2+b2
Severity: critical
Tags: security upstream

Quoting https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8126
> Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE
> functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and
> 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote
> attackers to cause a denial of service (application crash) or possibly have
> unspecified other impact via a small bit-depth value in an IHDR (aka image
> header) chunk in a PNG image.

In particular, "1.1.x and 1.2.x before 1.2.54".

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.3.0-trunk-amd64 (SMP w/4 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libpng12-0 depends on:
ii  libc6              2.19-22
ii  multiarch-support  2.19-22
ii  zlib1g             1:1.2.8.dfsg-2+b1

libpng12-0 recommends no packages.

libpng12-0 suggests no packages.

-- no debconf information