CVE-2015-8126: Multiple buffer overflows

For libpng12, it looks like these are the needed commits:

https://github.com/glennrp/libpng/commit/216dbf7f7eef5d999f2e3ba054407917098e9f85
https://github.com/glennrp/libpng/commit/3939689e7d9d06ee05411210bc8e605adcff294e
https://github.com/glennrp/libpng/commit/475bab6170f651b9863e9fc1b8ffd6cd89a45aa0

Debdiff for xenial incorporating the above upstream commits. Successfully builds in a clean xenial pbuilder.

debdiff for 15.10 security update

debdiff for 15.04 security update

debdiff for 14.04 security update

All of the above have been test build successfully with pbuilder for their respective releases. There doesn't seem to be any public POC yet...

Thanks for the debdiffs, building now for a security update!

This bug was fixed in the package libpng - 1.2.50-1ubuntu2.14.04.1

---------------
libpng (1.2.50-1ubuntu2.14.04.1) trusty-security; urgency=medium

  [ Andrew Starr-Bochicchio ]
  * SECURITY UPDATE: Multiple buffer overflows in the (1) png_set_PLTE
    and (2) png_get_PLTE (LP: #1516592).
    - debian/patches/CVE-2015-8126.diff: Prevent writing over-length
      PLTE chunk and silently truncate over-length PLTE chunk while reading.
      Backported from upstream patch.
    - CVE-2015-8126

  [ Marc Deslauriers ]
  * SECURITY UPDATE: out of bounds read in png_set_tIME
    - debian/patches/CVE-2015-7981.patch: check bounds in png.c and
      pngset.c.
    - CVE-2015-7981

 -- Marc Deslauriers <email address hidden> Thu, 19 Nov 2015 08:02:50 -0500

This bug was fixed in the package libpng - 1.2.51-0ubuntu3.15.10.1

---------------
libpng (1.2.51-0ubuntu3.15.10.1) wily-security; urgency=medium

  [ Andrew Starr-Bochicchio ]
  * SECURITY UPDATE: Multiple buffer overflows in the (1) png_set_PLTE
    and (2) png_get_PLTE (LP: #1516592).
    - debian/patches/CVE-2015-8126.diff: Prevent writing over-length
      PLTE chunk and silently truncate over-length PLTE chunk while reading.
      Backported from upstream patch.
    - CVE-2015-8126

  [ Marc Deslauriers ]
  * SECURITY UPDATE: out of bounds read in png_set_tIME
    - debian/patches/CVE-2015-7981.patch: check bounds in png.c and
      pngset.c.
    - CVE-2015-7981

 -- Marc Deslauriers <email address hidden> Thu, 19 Nov 2015 07:56:29 -0500

This bug was fixed in the package libpng - 1.2.51-0ubuntu3.15.04.1

---------------
libpng (1.2.51-0ubuntu3.15.04.1) vivid-security; urgency=medium

  [ Andrew Starr-Bochicchio ]
  * SECURITY UPDATE: Multiple buffer overflows in the (1) png_set_PLTE
    and (2) png_get_PLTE (LP: #1516592).
    - debian/patches/CVE-2015-8126.diff: Prevent writing over-length
      PLTE chunk and silently truncate over-length PLTE chunk while reading.
      Backported from upstream patch.
    - CVE-2015-8126

  [ Marc Deslauriers ]
  * SECURITY UPDATE: out of bounds read in png_set_tIME
    - debian/patches/CVE-2015-7981.patch: check bounds in png.c and
      pngset.c.
    - CVE-2015-7981

 -- Marc Deslauriers <email address hidden> Thu, 19 Nov 2015 07:59:38 -0500

This bug was fixed in the package libpng - 1.2.46-3ubuntu4.1

---------------
libpng (1.2.46-3ubuntu4.1) precise-security; urgency=medium

  [ Andrew Starr-Bochicchio ]
  * SECURITY UPDATE: Multiple buffer overflows in the (1) png_set_PLTE
    and (2) png_get_PLTE (LP: #1516592).
    - debian/patches/CVE-2015-8126.diff: Prevent writing over-length
      PLTE chunk and silently truncate over-length PLTE chunk while reading.
      Backported from upstream patch.
    - CVE-2015-8126

  [ Marc Deslauriers ]
  * SECURITY UPDATE: out of bounds read in png_set_tIME
    - debian/patches/CVE-2015-7981.patch: check bounds in png.c and
      pngset.c.
    - CVE-2015-7981
  * SECURITY UPDATE: out of bounds read in png_push_read_zTXt
    - debian/patches/CVE-2012-3425.patch: check for truncated chunk in
      pngpread.c.
    - CVE-2012-3425

 -- Marc Deslauriers <email address hidden> Thu, 19 Nov 2015 08:05:59 -0500

Thanks Marc!