Outdated "libpng" Library Contains Known Security Flaw in "uCrop"

[A-Yatsyk]

Version

• react-native-image-crop-picker v0.37.3
• react-native v0.67.4

Platform

• Android

Expected behaviour

No Known Security Flaw

Actual behaviour

The library "uCrop" contains known security flaw related to "libpng". Vulnerable was fixed in 1.6.32 uCrop Issue

Attachments

[midhunm-c]

@ivpusic is there any update on this issue? we are also facing the same issue with the libcrop.

A new version of uCrop (2.2.8-native) is available, may an update to this version will fix this issue. Could you please help us update the version and create a new npm build.

cc: @faizr

[oleksandr-dziuban]

Hi @midhunm-c , no 2.2.8 is pretty old version and contain same issue with library. We need uCrop library maintainers help so they could resolve this issue.

[e-pradeep]

Any update on this ticket?

[alicja-mruk]

Any update how to do it in the ucrop native package? @oleksandr-dziuban

[aryalprakash]

@alicja-mruk were you able to get a solution for this?

[alicja-mruk]

@aryalprakash you need to recompile the library with the latest version of libpng

[oleksandr-dziuban]

Hi, @alicja-mruk Not sure about this. Seems like libpng is dependency of ucrop library