PT-2017-14645 · Optipng+1 · Optipng+1

Nelson A. De Oliveira · Publicado 2017-11-24 · Atualizado 2024-06-15 · CVE-2017-16938

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OptiPNG version 0.7.6

Description A global buffer overflow allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.

Recommendations For OptiPNG version 0.7.6, consider restricting the use of the LZWReadByte function in the gifread.c file until a patch is available. Avoid processing maliciously crafted GIF format files to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2018-1888

CVE-2017-16938

DLA-1196-1

DSA-4058-1

MGASA-2017-0447

OPENSUSE-SU-2024:11131-1

Produtos afetados

Alt Linux

Optipng

Referências · 20

• https://cve.org/CVERecord?id=CVE-2017-16938 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-16938 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16938 · Aviso do Fabricante
• https://sourceforge.net/p/optipng/bugs/69 · Correção
• https://bugs.mageia.org/show_bug.cgi?id=22099 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-16938 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16938 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201801-02 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4058-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2008-5101 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16938 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16938 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2017-0447 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2017-0447.html · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2017/11/msg00042.html · Nota