-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 --------------------------------------------------------------------------
   Turbolinux Security Advisory TLSA-2004-19
   http://www.turbolinux.co.jp/security/
                                             security-team@turbolinux.co.jp
 --------------------------------------------------------------------------

 Original released date : 11 Aug 2004
 Last revised           : 18 Aug 2004

 Package : libpng

 Summary : Multiple vulnerabilities in libpng

 More information :
    The libpng package contains a library of functions for creating and manipulating
    PNG (Portable Network Graphics) image format files.

    Multiple buffer overflows and a potential NULL pointer dereference in libpng
    allow remote attackers to execute arbitrary code via malformed PNG images.

 Impact :
    This may allow remote attackers to execute arbitrary code via malformed PNG images.

 Affected Products :
    - Turbolinux Appliance Server 1.0 Hosting Edition
    - Turbolinux Appliance Server 1.0 Workgroup Edition
    - Turbolinux 10 F...
    - Turbolinux 10 Desktop
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server
    - Turbolinux 7 Workstation

 Solution :
    Please use the turbopkg (zabom) tool to apply the update. 
 ---------------------------------------------
 [Turbolinux 10 Desktop, Turbolinux 10 F...]
 # zabom -u libpng libpng-devel

 [other]
 # turbopkg
 or
 # zabom update libpng libpng-devel
 ---------------------------------------------


 <Turbolinux Appliance Server 1.0 Hosting Edition>

   Source Packages
   Size : MD5

   libpng-1.2.4-6.src.rpm
       401986 2bf547749b4db01ab735a0b3339e20a3

   Binary Packages
   Size : MD5

   libpng-1.2.4-6.i586.rpm
       136121 615e4c84f4de23730382719da42ef395

 <Turbolinux Appliance Server 1.0 Workgroup Edition>

   Source Packages
   Size : MD5

   libpng-1.2.4-6.src.rpm
       401986 925ef8cd5b5a5c9dc57c77051992cdf3

   Binary Packages
   Size : MD5

   libpng-1.2.4-6.i586.rpm
       136024 caae4fd1f5323ffe5a6ee20912de973b

 <Turbolinux 10 Desktop, Turbolinux 10 F...>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/SRPMS/libpng-1.2.5-7.src.rpm
       391811 46947a527b4cd5dc78aadf2b4d2c7261
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/SRPMS/libpng-compat-1.0.12-8.src.rpm
       492223 7e816499cadf8a06bf3149caceb8affd

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/libpng-1.2.5-7.i586.rpm
       135362 06f452d92b8301195daad8dd50c0c3c8
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/libpng-compat-1.0.12-8.i586.rpm
       126147 8d2d31880d517b9e6bf745bccc54e7c9
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/libpng-compat-devel-1.0.12-8.i586.rpm
       152774 ed6258e00a3f5bbf53238a1b3844bffa
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/libpng-devel-1.2.5-7.i586.rpm
       162732 8678def943d3c96fff879aa28fc261e3

 <Turbolinux 8 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/libpng-1.2.4-6.src.rpm
       401986 5fe0de02a33914de99aebd6cb6dd9df0
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/libpng-compat-1.0.12-8.src.rpm
       492223 61d1560e4ef8fed88d692ad25d6b478a

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/libpng-1.2.4-6.i586.rpm
       136010 4dd58ba3496bca4b8a0638fc55faf3c8
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/libpng-compat-1.0.12-8.i586.rpm
       127719 20db3be96e43ba614e995df4d79e24ff
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/libpng-compat-devel-1.0.12-8.i586.rpm
       151400 439f3944ebe2d933a87a3ac30efc4c2a
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/libpng-devel-1.2.4-6.i586.rpm
       159730 a20019b49ccd938c2b81cc68caf68bbc

 <Turbolinux 8 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/libpng-1.2.4-6.src.rpm
       401986 9636976c4d16dde18a3e19ffcc6d16fd
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/libpng-compat-1.0.12-8.src.rpm
       492223 9ff5dba68cb734cfb88187532539efca

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/libpng-1.2.4-6.i586.rpm
       136088 74e0096821f3aad31636b2016a18b65f
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/libpng-compat-1.0.12-8.i586.rpm
       127742 8729afed9d2cd422854c8277d6bca9cf
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/libpng-compat-devel-1.0.12-8.i586.rpm
       151353 f81f7f670176bad83257925e72b14dee
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/libpng-devel-1.2.4-6.i586.rpm
       159786 091c305cbb0aadb972081d647f584321

 <Turbolinux 7 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/libpng-1.0.12-8.src.rpm
       493276 e0036bead06655145ef106b4489edc05
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/libpng-compat-1.0.12-8.src.rpm
       492223 7ce207084cc91d347270d1f700ad2a91

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/libpng-1.0.12-8.i586.rpm
       125642 c3be47770f71d9e4067ce5f37f2e21a2
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/libpng-compat-1.0.12-8.i586.rpm
       125091 91936d2c9c0ce3c1d3b665eb21c1a965
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/libpng-compat-devel-1.0.12-8.i586.rpm
       147172 63464e9aeb6f2d0a3b3bb4feb5bde307
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/libpng-devel-1.0.12-8.i586.rpm
       147675 ed408da221957bb46762f621e1a3cb72

 <Turbolinux 7 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/libpng-1.0.12-8.src.rpm
       493276 b07298e0b9701c81803a4d2f10e1e741
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/libpng-compat-1.0.12-8.src.rpm
       492223 398fb603d8c1078dd56c97a19d59b322

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/libpng-1.0.12-8.i586.rpm
       125613 5728ec3dfaa5a653487cd87744520c2d
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/libpng-compat-1.0.12-8.i586.rpm
       125079 6c34fd616c40dc75283beb58a8df5712
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/libpng-compat-devel-1.0.12-8.i586.rpm
       147175 82102e85a964ac1563ff70f59f238e91
   ftp://ftp.turbolinux.com/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/libpng-devel-1.0.12-8.i586.rpm
       147694 d17ebd83a5ae8574c4eb88f9c6752d12


 References:

 CVE
   [CAN-2004-0421]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0421
   [CAN-2004-0597]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597
   [CAN-2004-0598]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598
   [CAN-2004-0599]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599


 --------------------------------------------------------------------------
 Revision History
    11 Aug 2004 Initial release
    18 Aug 2004 Removed Turbolinux Server 6.5, Turbolinux Advanced Server 6
                Turbolinux Server 6.1, Turbolinux Workstation 6.0
 --------------------------------------------------------------------------

 Copyright(C) 2004 Turbolinux, Inc. All rights reserved. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBIvzQK0LzjOqIJMwRAt7bAJ9E3Lgu/e3YbGwBNkyKo2kMyDsWXQCgkxYq
zt0K0QxhLApFRP/P6+GA+i4=
=v1lp
-----END PGP SIGNATURE-----