PT-2009-1077 · Libpng · Libpng

Publicado 2009-02-20 · Atualizado 2018-10-11 · CVE-2008-6218

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libpng versions prior to 1.2.33 rc02 libpng versions prior to 1.4.0 beta36 libpng versions prior to 1.2.35

Description The issue is related to a memory leak in the png handle tEXt function in pngrutil.c, which allows context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted PNG file. Multiple vulnerabilities in the libpng package can lead to disruption of protected information availability, and exploitation can be done remotely.

Recommendations For libpng versions prior to 1.2.33 rc02, update to version 1.2.33 rc02 or later. For libpng versions prior to 1.4.0 beta36, update to version 1.4.0 beta36 or later. For libpng versions prior to 1.2.35, update to version 1.2.35 or later.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-09372

CVE-2008-6218

DSA-1750-1

Produtos afetados

Libpng

Referências · 18

• http://securitytracker.com/id?1021104 · Nota
• http://securityfocus.com/archive/1/501767/100/0/threaded · Nota
• http://secunia.com/advisories/34388 · Nota
• http://debian.org/security/2009/dsa-1750 · Aviso do Fabricante
• http://sourceforge.net/project/shownotes.php?release_id=635837 · Correção
• http://vupen.com/english/advisories/2008/2917 · Nota
• https://bdu.fstec.ru/vul/2015-09372 · Nota de Segurança
• http://secunia.com/advisories/32418 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-6218 · Nota de Segurança
• http://secunia.com/advisories/34320 · Nota
• http://sourceforge.net/project/shownotes.php?release_id=635463&group_id=5624 · Correção
• http://mandriva.com/security/advisories?name=MDVSA-2010:133 · Aviso do Fabricante
• http://secunia.com/advisories/34265 · Nota
• http://securityfocus.com/bid/31920 · Nota
• http://wiki.rpath.com/Advisories:rPSA-2009-0046 · Nota