Upgrade libpng to 1.6.37 (fixes vulnerability)
mkoeppe opened this issue · 14 comments
The libpng homepage warns:
Vulnerability Warning
libpng versions 1.6.36 and earlier have a use-after-free bug in
the simplified libpng API png_image_free(). It has been assigned
ID CVE-2019-7317.
The vulnerability is fixed in version 1.6.37,
released on 15 April 2019.
Before this ticket we have libpng 1.6.29 which
has the vulnerability. This ticket upgrades to
libpng 1.6.37 which fixes it.
Previous update: #22159 (1.6.29)
Tarball: see checksums.ini
CC: @jpflori @frederichan-IMJPRG @tscrim @slel @dimpase
Component: packages: standard
Author: Matthias Koeppe
Reviewer: Dima Pasechnik
Issue created by migration from https://trac.sagemath.org/ticket/30564
Author: Matthias Koeppe
Description changed:
---
+++
@@ -1,4 +1,17 @@
-http://www.libpng.org/pub/png/libpng.html
+The [libpng homepage](http://www.libpng.org/pub/png/libpng.html) warns:
+
+> Vulnerability Warning
+>
+>
+> libpng versions 1.6.36 and earlier have a use-after-free bug in
+> the simplified libpng API png_image_free(). It has been assigned
+> ID [CVE-2019-7317](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7317).
+> The vulnerability is fixed in version 1.6.37,
+> released on 15 April 2019.
+
+Before this ticket we have libpng 1.6.29 which
+has the vulnerability. This ticket upgrades to
+libpng 1.6.37 which fixes it.
Previous update: #22159 (1.6.29)
lgtm
Reviewer: Dima Pasechnik
Thanks!
Changed branch from u/mkoeppe/upgrade_libpng_to_1_6_37__fixes_vulnerability_ to d6c59f4
************************************************************************
Traceback (most recent call last):
File "setup.py", line 48, in <module>
from sage_setup.command.sage_build_cython import sage_build_cython
File "/Users/buildbot-sage/slave/sage_git/build/src/sage_setup/command/sage_build_cython.py", line 19, in <module>
from sage_setup.library_order import library_order
File "/Users/buildbot-sage/slave/sage_git/build/src/sage_setup/library_order.py", line 35, in <module>
png_pc = pkgconfig.parse('libpng')
File "/Users/buildbot-sage/slave/sage_git/build/local/lib/python3.8/site-packages/pkgconfig/pkgconfig.py", line 248, in parse
_raise_if_not_exists(package)
File "/Users/buildbot-sage/slave/sage_git/build/local/lib/python3.8/site-packages/pkgconfig/pkgconfig.py", line 103, in _raise_if_not_exists
raise PackageNotFoundError(package)
pkgconfig.pkgconfig.PackageNotFoundError: libpng not found
************************************************************************
hmm, libpng installs an unversioned libpng.pc, which is a link to libpng16.pc - could it be that pkgconfig.parse('libpng') does not like it (on macOS - it seems)?
Moving to 9.4, as 9.3 has been released.