PT-2016-3254 · Libpng+3 · Libpng+3

Patrick Keshishian · Publicado 2016-12-29 · Atualizado 2024-09-06 · CVE-2016-10087

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libpng versions 0.71 through 1.0.66 libpng versions 1.2.x through 1.2.56 libpng versions 1.4.x through 1.4.19 libpng versions 1.5.x through 1.5.27 libpng versions 1.6.x through 1.6.26

Description The issue is related to a null pointer dereference in the png set text 2 function of the libpng library. This can be exploited by a remote attacker to cause a denial of service by loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.

Recommendations For libpng versions 0.71 through 1.0.66, update to version 1.0.67 or later. For libpng versions 1.2.x through 1.2.56, update to version 1.2.57 or later. For libpng versions 1.4.x through 1.4.19, update to version 1.4.20 or later. For libpng versions 1.5.x through 1.5.27, update to version 1.5.28 or later. For libpng versions 1.6.x through 1.6.26, update to version 1.6.27 or later.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2017-1041

ALT-PU-2019-1318

AZL-44325

AZL-44883

BDU:2018-00462

CVE-2016-10087

MGASA-2017-0020

OESA-2024-2091

OPENSUSE-SU-2024:10971-1

OPENSUSE-SU-2024:10972-1

SUSE-SU-2017:0853-1

SUSE-SU-2017:0860-1

SUSE-SU-2017:0901-1

SUSE-SU-2017:0950-1

SUSE-SU-2017_0853-1

USN-3712-1

USN-3712-2

Produtos afetados

Alt Linux

Suse

Ubuntu

Libpng

Referências · 68

• https://usn.ubuntu.com/3712-1 · Aviso do Fabricante
• https://sourceforge.net/p/libpng/code/ci/812768d7a9c973452222d454634496b25ed415eb · Nota
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · Nota
• https://sourceforge.net/p/libpng/code/ci/794a15fad6add4d636369d0b46f603a02995b2e2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8126 · Nota de Segurança
• https://sourceforge.net/p/libpng/code/ci/243d4e5f3fe71740d52a53cf3dd77cc83a3430ba · Nota
• https://suse.com/security/cve/CVE-2016-5735 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10972-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2009-0040 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:0901-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-8472 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-10087 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3425 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2011-2501 · Nota de Segurança
• https://suse.com/security/cve/CVE-2018-13785 · Nota