Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0883
optipng security update
8 April 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: optipng
Publisher: Debian
Operating System: Debian GNU/Linux 7
Debian GNU/Linux 8
Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2016-2191 CVE-2015-7801
Original Bulletin:
http://www.debian.org/security/2016/dsa-3546
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running optipng check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3546-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
April 07, 2016 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : optipng
CVE ID : CVE-2016-2191
Hans Jerry Illikainen discovered that missing input sanitising in the
BMP processing code of the optipng PNG optimiser may result in denial of
service or the execution of arbitrary code if a malformed file is
processed.
For the oldstable distribution (wheezy), this problem has been fixed
in version 0.6.4-1+deb7u2. This update also fixes CVE-2015-7801, which
was originally targeted for a wheezy point update.
For the stable distribution (jessie), this problem has been fixed in
version 0.7.5-1+deb8u1.
For the unstable distribution (sid), this problem will be fixed soon.
We recommend that you upgrade your optipng packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJXBs41AAoJEBDCk7bDfE42jckP/30TKEuPGc7lfZ7rE4gMByRg
+hPq34K5p5v6Fo2/9TBWzNVyPF8Ez6Ns5JuVR7+5Ma+XW1AEPzUmrBaLPVSk9gm8
ADdT6/oyI83i+iCAQt1xBBejtu65NiYgMr0gFI+g+4JuisH/KmJDXTKrR/cEcAle
LLriZThk+9CMZ0MqxjvEUo9hBl6X+Wd0+k7ECv84+zFapi8XrWwuE+19sXMKwUEK
CceYvh8j3f1N02b1bKKPH1w0V1mIUi4PmbdmDGzJj5rvdHGYG2vFE+D5EXV5zQwl
tCDNDurkpkX2vl3c4ljFC3hXnBzJNEif7YMGpG3hp5xGL7eZuH0IMPqNHK1DM8dD
7H179HhnRkk4HZJQ1zyAULyjRL+3kcFM/1lpBDYbeZc4bgFjQZfEVM+Pfo5kQRsp
qEQ2fj02GxUJKDp70ELhEnOuMgkk+4Gh/ZhRjweYl2AyY7L08epiWIpZCC5ofVbl
C4+yysdPKtrOEjI+vab2AMjFxpZIAcwsfy1qwruyYhuvQWaOPKJp+Vgn89YtTzZH
q5VsqpaxCFm6wR4vZWece3kmLq84pAZ7BFHjTJVlo4haGh0gF42WYqHTbxaNGSy1
PIpBLLNgPLbP5gpCjV0bTg5+bLas7Dq/Mo8eHnSI7PguegyJ0F2SL+LqwAe68qhZ
RPHp4Cs6OqZ1nSRQ7U1/
=pI31
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVwcfnn6ZAP0PgtI9AQKVXBAAquEb+ZbhlPntJqM0r+nIRBikzFJNKIvL
RZXxYkkHyEbsBbC0qHenbwWeWm/8B9c/sgsO/ha48pW5HfzYZFIg8kGBUIQnL07j
9Gp9SUe7Eh8wVDY9fRDEZZmR9uXCvXAZao9S4nn6wLgNv3ibWWpoJzJYhrGA/4OU
l7o9Lh7nUkkZwiug1iWwDEmPHDXsWx7a0lG3A3r4o5QLdafha2HeMDzdO3JV/Kky
dX8yD6x3A7RmNzElS547tN4pHTQsPye5YLqd511z5ns/02j+MuaYrPLpzXDUFpw4
iipxaCDwf8SC3ylPPRO9gBnulBO+A7ufC9AicNZvIXpKumJM87zjZEZzNtT8n7y+
QqMTrSCTsJl8YJZ6M68bA0fC8rTNsL1LyXuRPjjQOKGMssxur2KscTryg5C4+Tau
12CObDVLi8I7UFKmab5+RIVMLAH/pPxuXurOxUS/p3BNo/X2q0tFu0zx0wUErOTx
iVzbtQnhqndBZaweOIPmLUraxI4CWE3lF4nYmn5Bs4pwCf/Fv1lwHxByhHR4DD1o
W/O8NOdevpfl2QmXe6+A2wlsOflFcsEvtOptA76f8NYdJZAQAHKEJFuanPg+mo+4
DzO+2JB2SgZqjPCjUhfMIOaOLlF0YgcFBJsKuxrb2OryyfZa7yPyOUUyrCG0ch6B
CEiRPw9RcUY=
=M6Vq
-----END PGP SIGNATURE-----