Format: 1.7
Date: Thu,  5 Aug 2004 12:31:39 +0200
Source: libpng
Binary: libpng2 libpng2-dev libpng10-dev libpng10-0
Architecture: source all m32r
Version: 1.0.15-6
Distribution: unstable
Urgency: high
Maintainer: Josselin Mouette <joss@debian.org>
Changed-By: Josselin Mouette <joss@debian.org>
Description: 
 libpng10-0 - PNG library, older version - runtime
 libpng10-dev - PNG library, older version - development
 libpng2    - PNG library, older version - runtime
 libpng2-dev - PNG library, older version - development
Closes: 263496
Changes: 
 libpng (1.0.15-6) unstable; urgency=high
 .
   * pngrtran.c: applied upstream patch 4 to fix incorrect calculation of
     buffer offsets [CAN-2004-0768].
   * png.h, pngpread.c, pngrutil.c: patch from Chris Evans
     <chris@scary.beasts.org> to fix several vulnerabilities (closes: #263496):
     + libpng fails to properly check length on PNG data [CAN-2004-0597].
     + libpng "png_handle_sBIT" does not perform proper checks to avoid stack
       buffer overflow [CAN-2004-0597].
     + libpng "png_handle_iCCP" possible NULL-pointer crash
       [CAN-2004-0598].
     + libpng "png_handle_sPLT" possible integer overflow
       [CAN-2004-0599].
     + libpng "png_read_png" does not properly handle a PNG with excessive
       height (integer overflow) [CAN-2004-0599].
     + libpng progressive reading integer overflow [CAN-2004-0599].
Files: 
 fb37075446c88751ad628b7cf6931730 373 libs optional libpng_1.0.15-6.dsc
 dd560ebd7dfef05e7294007946e99ee3 14152 libs optional libpng_1.0.15-6.diff.gz
 e6e7d41c1851e669c1a12eee7f02d549 950 libs optional libpng2_1.0.15-6_all.deb
 4cd39f0d3584d6e5be892516ae93f2cd 1174 libdevel extra libpng2-dev_1.0.15-6_all.deb
 4c11584df5b56e32d4f36893b969ea66 113578 libs optional libpng10-0_1.0.15-6_m32r.deb
 21f365d0e92db22d98d79a27e75b5510 194696 libdevel optional libpng10-dev_1.0.15-6_m32r.deb