3 ms·
From CVE: >and 1.6.x before 1.6.19 Unfortunately, the latest version on libpng site [0] is 1.6.18. Why was this CVE announced before the patch and version up
by Jerry2 11y ago
From CVE:
>and 1.6.x before 1.6.19
Unfortunately, the latest version on libpng site [0] is 1.6.18.
Why was this CVE announced before the patch and version update was released?
[0] http://www.libpng.org/pub/png/libpng.html http://www.libpng.org/pub/png/libpng.html
- taspeotis 11y agoThe Sourceforge site [0] is up to date: > UPDATE 12 November 2015: > The latest released versions are libpng-1.5.24 and libpng-1.6.19 [DOWNLOAD]. [0] http://libpng.sourceforge.net/index.html http://libpng.sourceforge.net/index.html
- ncw33 11y agoActually, the patch was announced before the details of the bug: I subscribe to the libpng mailing list, and got about a day's notice to ship the patch out before the CVE and associated details were widely publicised. They did a good job of notifying us quickly, before there was chance for the 'bad guys' to jump on my customers.
- cpncrunch 11y agoOne day isn't really long enough. I see there is no update for Centos 6 as yet.