libpng security vulnerability

Hi everyone, we have provided the binary fix for this issue as a QFE (“quick-fix”) which you can download and run from here: Current Available Quick-Fix Solutions - Announcements and Releases - Unreal Engine Forums

Cheers

Hi there! Here’s my problem… I publish an android game with this new libPNG with API 19 and I’ve notice that some textures are not showing during game. Sometimes the texture is loaded, sometimes not. If I use the API 21 all the textures become visible. I’ve already try to increase the memory poolsize and a bunch of other things. Is there a minimum API to use this lib? It’s a bug? I’m stuck here trying to solve this issue. If you have something to help me, I will be thankful. :slight_smile:
By the way, worked for me with 4.13 and 4.11 to.

libpng is not used for any textures unless you are using ImageWrapper so it should not cause this. Please create an AnswerHub for this issue.

I’ll do that! Thank you!

Big thanks for the QFE, it will help our project move forward.

I tried the QFE patch that was posted, but my app is still being rejected for the same reason. Any help?

4.13.2 includes the update; this would be the preferred way to update 4.13 if you aren’t using GitHub.

hi, i need help with my app. if someone can help me .I would be very grateful. i must finih project today. sms android app. is anyone intrested to help me

Hi!
I am using 4.12.5 and I am very close to my release date. Update Unreal is not really a good option for me since I am using third party plugins and last update was a disaster.

Is there any procedure to fix this problem for 4.12.5 launcher version?

My project is completely done in blueprints. I am a 3d artist, not a programmer and I’ve never used UE4 source from github.

Thank you very much!

So 4.13.2 launcher version is allready contains update?

@KAPA6UH: 4.13.2 contains the update.
@Nomte: unfortunately the code needs to be recompiled with the new headers and library. The ZIP patch in post #3 above does work with 4.12.5, but you will need to get the engine source from GitHub, apply it, and compile.

Yeah it is, but after moving to 4.13.2 I can’t login to googleplay services anymore which I have implemented in 4.11 . While compiling I’m getting such a warning LogScriptCore:Warning: Script Msg: ShowLoginUI - Invalid or uninitialized OnlineSubsystem . What have I missed?

This message happens if you don’t have the Online Subsystem GooglePlay plugin enabled (it moved to a plugin, but should be enabled by default). It would be best to move this to AnswerHub. Attaching your device logcat will help.

Saved my day :smiley:
using 4.12.5 here
Thanks a lot

thanks for this, saved my day too

There have been multiple security vulnerabilities identified in the libpng library over the years, which is a popular open-source software library for working with PNG image files. Some of the most notable vulnerabilities include:

CVE-2015-8540: This vulnerability allowed an attacker to trigger an out-of-bounds read in the png_convert_to_rfc1123() function, which could lead to a crash or information disclosure.

CVE-2016-10087: This vulnerability allowed an attacker to trigger an out-of-bounds read in the png_set_text_2() function[,](https://youtubevanced.org) which could lead to a crash or information disclosure.

CVE-2019-7317: This vulnerability allowed an attacker to trigger a heap-based buffer overflow in the png_image_free() function, which could lead to remote code execution.

It is important to keep libpng up to date and to patch any security vulnerabilities as soon as possible. Most Linux distributions and other software platforms have mechanisms for automatically updating software packages, including libraries like libpng. If you are a software developer or maintain a software project that uses libpng, make sure to update to the latest version of the library and check for any potential security vulnerabilities.