PT-2017-4283 · Png Development+6 · Libpng+6

Publicado 2017-08-04 · Atualizado 2024-09-06 · CVE-2017-12652

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: libpng versions prior to 1.6.32

Description: The issue is related to insufficient input validation in the libpng library, which can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The problem arises from the library's failure to properly check the length of chunks against the user limit.

Recommendations: For versions prior to 1.6.32, update to version 1.6.32 or later to resolve the issue. As a temporary workaround, consider restricting the use of libpng until a patch is applied.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2018-2451

AZL-43468

AZL-43573

AZL-44469

AZL-44973

AZL-45045

AZL-45102

BDU:2023-07738

CESA-2020_3901

CVE-2017-12652

OESA-2024-2091

OPENSUSE-SU-2024:10971-1

OPENSUSE-SU-2024:10972-1

RHSA-2020:3901

RHSA-2020_3901

SUSE-SU-2019:3060-2

SUSE-SU-2019_3060-1

SUSE-SU-2019_3060-2

SUSE-SU-2020:0911-1

SUSE-SU-2020_0911-1

SUSE-SU-2023:3799-1

SUSE-SU-2023_3799-1

SUSE-SU-2026:1716-1

USN-5432-1

USN-5432-2

Produtos afetados

Alt Linux

Astra Linux

Centos

Red Hat

Suse

Ubuntu

Libpng

Referências · 71

• https://github.com/pnggroup/libpng/commit/347538efbdc21b8df684ebd92d37400b3ce85d55 · Nota
• https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE · Nota
• https://github.com/glennrp/libpng/commit/13bc0b6b1f8f2f2491fcc9f0c1c939ff06e13c15 · Nota
• https://github.com/glennrp/libpng/commit/2dbef2f2a9e759a80d2decb6862518acf4919c59 · Nota
• https://github.com/glennrp/libpng/commit/fcd1bb93124d76059abef98216d8390f520c577b · Nota
• https://github.com/glennrp/libpng/commit/2dca15686fadb1b8951cb29b02bad4cae73448da · Nota
• https://github.com/glennrp/libpng/commit/095b4ce16bb46acb259ea1a4ca6562a623e58d93 · Nota
• https://github.com/glennrp/libpng/commit/347538efbdc21b8df684ebd92d37400b3ce85d55 · Nota
• https://github.com/glennrp/libpng/commit/a1fe2c98489519d415b72bc0026f0c86d82278b7 · Nota
• https://suse.com/support/update/announcement/2020/suse-su-20200911-1 · Nota
• https://ubuntu.com/security/notices/USN-5432-2 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-5735 · Nota
• https://suse.com/security/cve/CVE-2018-13785 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12652 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-2691 · Nota de Segurança