Index: graphics/png/Makefile =================================================================== --- graphics/png/Makefile +++ graphics/png/Makefile @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= png -PORTVERSION= 1.6.18 +PORTVERSION= 1.6.19 CATEGORIES= graphics MASTER_SITES= SF/lib${PORTNAME}/lib${PORTNAME}16/${PORTVERSION} PATCH_SITES= SF/apng/lib${PORTNAME}/lib${PORTNAME}16/ Index: graphics/png/distinfo =================================================================== --- graphics/png/distinfo +++ graphics/png/distinfo @@ -1,4 +1,4 @@ -SHA256 (libpng-1.6.18.tar.xz) = 2e10c13b7949883ac961db6177c516d778184432d440317e9f0391305c360963 -SIZE (libpng-1.6.18.tar.xz) = 932324 -SHA256 (libpng-1.6.18-apng.patch.gz) = 1d595b3b33c09529dddf869ca69f386528dfe1b991d2679377082e2acbca7009 -SIZE (libpng-1.6.18-apng.patch.gz) = 9940 +SHA256 (libpng-1.6.19.tar.xz) = 311c5657f53516986c67713c946f616483e3cdb52b8b2ee26711be74e8ac35e8 +SIZE (libpng-1.6.19.tar.xz) = 941280 +SHA256 (libpng-1.6.19-apng.patch.gz) = 5ec713a51c35c25d5e53dd61270a6fd5313b26872b382f0fbaed41a0743768a2 +SIZE (libpng-1.6.19-apng.patch.gz) = 10330 Index: graphics/png/pkg-plist =================================================================== --- graphics/png/pkg-plist +++ graphics/png/pkg-plist @@ -13,7 +13,7 @@ lib/libpng16.a lib/libpng16.so lib/libpng16.so.16 -lib/libpng16.so.16.18.0 +lib/libpng16.so.16.19.0 libdata/pkgconfig/libpng.pc libdata/pkgconfig/libpng16.pc man/man3/libpng.3.gz Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml +++ security/vuxml/vuln.xml @@ -58,6 +58,37 @@ --> + + libpng buffer overflow in png_set_PLTE + + + png + 1.6.19 + + + + +

libpng reports:

+
CVE for a vulnerability in libpng, all versions, in the + png_set_PLTE/png_get_PLTE functions. These functions failed to check for + an out-of-range palette when reading or writing PNG files with a bit_depth + less than 8. Some applications might read the bit depth from the IHDR + chunk and allocate memory for a 2^N entry palette, while libpng can return + a palette with up to 256 entries even when the bit depth is less than 8.
+

+ + + + http://www.openwall.com/lists/oss-security/2015/11/12/2 + CVE-2015-8126 + + + 2015-11-15 + 2015-11-15 + + + flash -- multiple vulnabilities