PT-2015-3261 · Libpng+5 · Libpng+5
Padma81
·
Publicado
2015-12-11
·
Atualizado
2024-09-06
·
CVE-2015-8540
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libpng versions 0.90 through 0.99
libpng versions 1.0.x before 1.0.66
libpng versions 1.1.x and 1.2.x before 1.2.56
libpng versions 1.3.x and 1.4.x before 1.4.19
libpng versions 1.5.x before 1.5.26
Description
The issue is caused by an integer underflow in the
png check keyword function in pngwutil.c, which allows remote attackers to have an unspecified impact via a space character as a keyword in a PNG image, triggering an out-of-bounds read. This could potentially affect the integrity, availability, and confidentiality of information. The vulnerability may be exploited by sending a specially crafted PNG image with a space character in the keyword.Recommendations
For libpng versions 0.90 through 0.99, update to a version outside of this range to mitigate the issue.
For libpng versions 1.0.x before 1.0.66, update to version 1.0.66 or later.
For libpng versions 1.1.x and 1.2.x before 1.2.56, update to version 1.2.56 or later.
For libpng versions 1.3.x and 1.4.x before 1.4.19, update to version 1.4.19 or later.
For libpng versions 1.5.x before 1.5.26, update to version 1.5.26 or later.
As a temporary workaround, consider restricting the use of PNG images with space characters in keywords until a patch is available.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Ibm Aix
Red Hat
Suse
Ubuntu
Libpng