PT-2009-1076 · Libpng · Libpng

Jon Foster · Publicado 2009-01-15 · Atualizado 2018-11-08 · CVE-2008-5907

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libpng versions 1.0.0 through 1.0.41 libpng versions 1.2.x through 1.2.33

Description The issue in libpng might allow attackers to set the value of an arbitrary memory location to zero via crafted PNG files with keywords, related to an implicit cast of the '0' character constant to a NULL pointer. This is related to the png check keyword function in pngwutil.c. Multiple vulnerabilities in the libpng package can lead to disruption of protected information and can be exploited remotely.

Recommendations For libpng versions 1.0.0 through 1.0.41, update to version 1.0.42 or later. For libpng versions 1.2.x through 1.2.33, update to version 1.2.34 or later.

Correção

Identificadores relacionados

BDU:2015-09372

CVE-2008-5907

DSA-1750-1

Produtos afetados

Libpng

Referências · 12

• http://sourceforge.net/mailarchive/forum.php?thread_name=4B6F0239C13D0245820603C036D180BC79FBAA%40CABOTUKEXCH01.cabot.local&forum_name=png-mng-implement · Nota
• http://debian.org/security/2009/dsa-1750 · Aviso do Fabricante
• http://secunia.com/advisories/34388 · Nota
• https://bdu.fstec.ru/vul/2015-09372 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48128 · Nota
• http://libpng.sourceforge.net/index.html · Nota
• http://security.gentoo.org/glsa/glsa-200903-28.xml · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2009/01/09/1 · Nota
• http://secunia.com/advisories/34320 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2009:051 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-5907 · Nota de Segurança