PT-2007-1118 · Libpng · Libpng
Publicado
2007-10-08
·
Atualizado
2018-10-26
·
CVE-2007-5266
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions:
libpng versions prior to 1.0.29 beta1
libpng versions 1.2.x prior to 1.2.21 beta1
Description:
The issue is related to an off-by-one error in ICC profile chunk handling in the png set iCCP function in pngset.c. This error allows remote attackers to cause a denial of service (crash) via a crafted PNG image that prevents a name field from being NULL terminated. Multiple vulnerabilities in the libpng package can lead to disruption of protected information availability, and exploitation can be done remotely.
Recommendations:
For libpng versions prior to 1.0.29 beta1, update to version 1.0.29 beta1 or later.
For libpng versions 1.2.x prior to 1.2.21 beta1, update to version 1.2.21 beta1 or later.
As a temporary workaround, consider restricting the use of the png set iCCP function until a patch is available.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Libpng