Libpng Updates Fix 21-Year-Old Null Dereference Bug
Written by Michael Larabel in Free Software on 29 December 2016 at 12:22 PM EST. 29 Comments
FREE SOFTWARE --
Libpng 1.6.27, 1.5.28, 1.4.20, 1.2.57, and 1.0.67 were all released today to fix a pointer null dereference bug dating back to 1995.

From the mailing list announcement:
These all fix a potential "NULL dereference" bug that has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened.

Great to see that bug being discovered and fixed after 21 years. There are also a few other minor updates to find with libpng 1.6.27.

Here's to hoping for more open-source/Linux security and bug-fixing improvements in 2017!

About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Related Free Software News
Popular News This Week