CVE-2016-3189 bzip2: heap use after free in bzip2recover

CVE-2016-3189 bzip2: heap use after free in bzip2recover

MinGW cross compiled libpng 1.6.27 release, fixing a potential security issue. For details, see https://sourceforge.net/p/png-mng/mailman/message/35575076/

MinGW cross compiled libpng 1.6.27 release, fixing a potential security issue. For details, see https://sourceforge.net/p/png-mng/mailman/message/35575076/

libpng 1.6.27 release, fixing a potential security issue. For details, see https://sourceforge.net/p/png-mng/mailman/message/35575076/

libpng 1.6.27 release, fixing a potential security issue. For details, see https://sourceforge.net/p/png-mng/mailman/message/35575076/

This update fixes an old NULL pointer dereference bug in png_set_text_2() discovered and patched by Patrick Keshishian. The potential “NULL dereference” bug has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened.

The update also fixes some documentation typos and an instance of undefined behavior.

This update fixes an old NULL pointer dereference bug in png_set_text_2() discovered and patched by Patrick Keshishian. The potential “NULL dereference” bug has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened.

The update also fixes some documentation typos and an instance of undefined behavior.

This update fixes an old NULL pointer dereference bug in png_set_text_2() discovered and patched by Patrick Keshishian. The potential “NULL dereference” bug has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened.

The update also fixes some documentation typos and an instance of undefined behavior.

**Version 5.4.5** (2016-12-29)

* SECURITY FIX: fixed CVE-2016-10074 by disallowing potentially unsafe shell characters

Prior to 5.4.5, the mail transport (Swift_Transport_MailTransport) was vulnerable to passing
arbitrary shell arguments if the “From”, “ReturnPath” or “Sender” header came
from a non-trusted source, potentially allowing Remote Code Execution

* deprecated the mail transport