Mageia alert MGASA-2025-0314 (libpng)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2025-0314: Updated libpng packages fix security vulnerabilities
Date:
             
 
Mon, 01 Dec 2025 23:01:45 +0100
Message-ID:
             
 
<20251201220145.CB082A0D57@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2025-0314 - Updated libpng packages fix security vulnerabilities

Publication date: 01 Dec 2025
URL: https://advisories.mageia.org/MGASA-2025-0314.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2025-64505,
     CVE-2025-64506,
     CVE-2025-64720,
     CVE-2025-65018

Description:
LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via
malformed palette index. (CVE-2025-64505)
LIBPNG is vulnerable to a heap buffer over-read in
`png_write_image_8bit` with grayscale+alpha or RGB/RGBA images.
(CVE-2025-64506)
LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite`
via incorrect palette premultiplication. (CVE-2025-64720)
 LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row`
triggered via `png_image_finish_read`. (CVE-2025-65018)

References:
- https://bugs.mageia.org/show_bug.cgi?id=34766
- https://www.openwall.com/lists/oss-security/2025/11/22/1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6...

SRPMS:
- 9/core/libpng-1.6.38-1.1.mga9