PT-2016-5054 · Open Source+1 · Optipng+1

Hans Jerry Illikainen · Publicado 2016-04-07 · Atualizado 2024-06-15 · CVE-2016-2191

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OptiPNG versions prior to 0.7.6

Description The issue allows remote attackers to cause a denial of service, resulting in an invalid memory write and crash. This is achieved through a series of delta escapes in a crafted BMP image, specifically targeting the bmp read rows function in pnxtern/pngxrbmp.c.

Recommendations For versions prior to 0.7.6, update to version 0.7.6 or later to resolve the issue. As a temporary workaround, consider restricting the processing of BMP images from untrusted sources until the update is applied.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-2191

DSA-3546-1

MGASA-2016-0135

OPENSUSE-SU-2024:10140-1

USN-2951-1

Produtos afetados

Optipng

Ubuntu

Referências · 31

• 🔥 http://packetstormsecurity.com/files/136553/Optipng-Invalid-Write.html · Exploit
• https://ubuntu.com/security/CVE-2016-2191 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-2951-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2951-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3546-1 · Aviso do Fabricante
• https://sourceforge.net/p/optipng/bugs/53 · Nota
• http://openwall.com/lists/oss-security/2016/04/04/2 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2191 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2016/Apr/15 · Nota
• https://ubuntu.com/security/CVE-2015-7801 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-3982 · Aviso do Fabricante
• https://sourceforge.net/p/optipng/bugs/59 · Correção
• https://osv.dev/vulnerability/MGASA-2016-0135 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-2191 · Nota
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html · Aviso do Fabricante