PT-2008-5294 · Libpng · Libpng

Publicado

2008-09-10

·

Atualizado

2024-06-15

·

CVE-2008-3964

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions libpng versions prior to 1.2.32beta01 libpng versions 1.4 prior to 1.4.0beta34
Description The issue is related to multiple off-by-one errors in libpng, allowing context-dependent attackers to cause a denial of service or have unspecified other impact via a PNG image with crafted zTXt chunks. This is related to the png push read zTXt function in pngread.c and possibly pngtest.c.
Recommendations For libpng versions prior to 1.2.32beta01, update to version 1.2.32beta01 or later. For libpng versions 1.4 prior to 1.4.0beta34, update to version 1.4.0beta34 or later. As a temporary workaround, consider restricting the use of crafted zTXt chunks in PNG images until a patch is available.

Exploit

Correção

DoS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-193

Identificadores relacionados

CVE-2008-3964
OPENSUSE-SU-2024:10972-1

Produtos afetados

Libpng