MGASA-2014-0210

Updated libpng12 and libpng packages fix security vulnerabilities:

An integer overflow leading to a heap-based buffer overflow was found in the pngsetsPLT() and pngsettext2() API functions of libpng. An attacker could create a specially-crafted image file and render it with an application written to explicitly call pngsetsPLT() or pngsettext2() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application (CVE-2013-7353).

An integer overflow leading to a heap-based buffer overflow was found in the pngsetunknownchunks() API function of libpng. An attacker could create a specially-crafted image file and render it with an application written to explicitly call pngsetunknownchunks() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application (CVE-2013-7354).