Libpng Updates Fix 21-Year-Old Null Dereference Bug

Articles & Reviews
News Archive
Forums
Premium
Categories

Computers GPUs / Graphics Cards Linux Gaming Memory Motherboards CPUs / Processors Software Storage Operating Systems Peripherals

Libpng Updates Fix 21-Year-Old Null Dereference Bug

Written by Michael Larabel in Free Software on 29 December 2016 at 12:22 PM EST. 29 Comments

Libpng 1.6.27, 1.5.28, 1.4.20, 1.2.57, and 1.0.67 were all released today to fix a pointer null dereference bug dating back to 1995.

From the mailing list announcement:

These all fix a potential "NULL dereference" bug that has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened.

Great to see that bug being discovered and fixed after 21 years. There are also a few other minor updates to find with libpng 1.6.27.

Here's to hoping for more open-source/Linux security and bug-fixing improvements in 2017!

29 Comments

GIMP 2.10.24 Released For This Open-Source Adobe Photoshop Alternative

Box86 Continues Quest For Running x86 Linux Programs On ARM, Other Archs

The Linux Foundation Wants To Help Water Farms From The Cloud

FreeCAD 0.19 Released For Advancing Open-Source CAD Software

Software-Defined Radio Benchmarks, Other Updates This Week

About The Author

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.