PT-2016-3663 · Png Development+3 · Libpng+4
Publicado
2016-02-02
·
Atualizado
2019-06-19
·
CVE-2015-5041
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
IBM SDK, Java Technology Edition versions 6 before SR16 FP20
IBM SDK, Java Technology Edition 6 R1 versions before SR8 FP20
IBM SDK, Java Technology Edition 7 versions before SR9 FP30
IBM SDK, Java Technology Edition 7 R1 versions before SR3 FP30
libpng (affected versions not specified)
Description
The issue allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods. Additionally, a buffer overflow vulnerability exists due to a read underflow in
png check keyword in pngwutil.c, which can be exploited by sending an overly long argument, potentially allowing a remote attacker to execute arbitrary code on the system or cause the application to crash.Recommendations
For IBM SDK, Java Technology Edition 6 before SR16 FP20, update to SR16 FP20 or later.
For IBM SDK, Java Technology Edition 6 R1 before SR8 FP20, update to SR8 FP20 or later.
For IBM SDK, Java Technology Edition 7 before SR9 FP30, update to SR9 FP30 or later.
For IBM SDK, Java Technology Edition 7 R1 before SR3 FP30, update to SR3 FP30 or later.
For libpng, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ibm Aix
Ibm Sdk
Red Hat
Suse
Libpng