CVE-2015-8126: Multiple buffer overflows in libpng

Re:CVE-2015-8126: Multiple buffer overflows in libpng by Jerry2 on Saturday November 14, 2015 @02:22PM (#10566838)

From CVE:

>and 1.6.x before 1.6.19

Unfortunately, the latest version on libpng site [0] is 1.6.18.

Why was this CVE announced before the patch and version update was released?

[0] http://www.libpng.org/pub/png/libpng.html

[ Parent | on HN ]

Re:CVE-2015-8126: Multiple buffer overflows in libpng by ncw33 on Saturday November 14, 2015 @02:54PM (#10566974)

Actually, the patch was announced before the details of the bug: I subscribe to the libpng mailing list, and got about a day's notice to ship the patch out before the CVE and associated details were widely publicised. They did a good job of notifying us quickly, before there was chance for the 'bad guys' to jump on my customers.

[ Parent | on HN ]

Re:CVE-2015-8126: Multiple buffer overflows in libpng by cpncrunch on Saturday November 14, 2015 @05:08PM (#10567482)

One day isn't really long enough. I see there is no update for Centos 6 as yet.

[ Parent | on HN ]

Re:CVE-2015-8126: Multiple buffer overflows in libpng by taspeotis on Saturday November 14, 2015 @02:29PM (#10566871)

The Sourceforge site [0] is up to date:

> UPDATE 12 November 2015:

> The latest released versions are libpng-1.5.24 and libpng-1.6.19 [DOWNLOAD].

[0] http://libpng.sourceforge.net/index.html

[ Parent | on HN ]