PT-2002-1065 · Libpng · Libpng

Publicado 2002-07-26 · Atualizado 2008-09-05 · CVE-2002-0728

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libpng versions 1.0.x before 1.0.14 libpng versions 1.2.x before 1.2.4

Description The issue affects the libpng package, allowing remote exploitation that may lead to a violation of confidentiality, integrity, and availability of protected information. A buffer overflow in the progressive reader for libpng can be triggered by a PNG data stream with more IDAT data than indicated by the IHDR chunk, causing a denial of service (crash).

Recommendations For libpng versions 1.0.x before 1.0.14, update to version 1.0.14 or later to resolve the issue. For libpng versions 1.2.x before 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of libpng until a patch is available.

Correção

Identificadores relacionados

BDU:2015-08153

BDU:2015-08154

CVE-2002-0728

DSA-140

Produtos afetados

Libpng

Referências · 9

• http://linux-mandrake.com/en/security/2002/MDKSA-2002-049.php · Aviso do Fabricante
• http://debian.org/security/2002/dsa-140 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-08154 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2003-006.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0728 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2002-152.html · Aviso do Fabricante
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000512 · Aviso do Fabricante
• ftp://swrinde.nde.swri.edu/pub/png-group/archives/png-list.200207 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-08153 · Nota de Segurança