community
community copied to clipboard
Discrepancy in libpng version installed with Kivy 2.3.1
When installing Kivy using pip install Kivy==2.3.1, it is observed that python3.10/site-packages/Kivy.libs/libpng15-ce838cd1.so.15.13.0 is included with the package. However, the repository contains a variable MANYLINUX__LIBPNG__VERSION="1.6.40" in tools/build_linux_dependencies.sh. This discrepancy between the versions is unexpected.
Is this a bug, or is the version locked for a specific reason? Alternatively, is there a Kivy package that includes libpng16*? There are open CVEs against version 15, and it is important to find the best way to use version 16.
Here are some CVEs for this package:
CVE-2015-0973 CVE-2016-10087 CVE-2016-3751 CVE-2015-8126
Thanks for the support!