PT-2017-6554 · Pngcrush+1 · Pngcrush+1

Vasyl Kaigorodov · Publicado 2015-03-10 · Atualizado 2018-11-30 · CVE-2015-2158

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pngcrush versions prior to 1.7.84

Description The issue is caused by an off-by-one error in the pngcrush measure idat function, which can be exploited by remote attackers using a crafted PNG file. This could lead to a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code.

Recommendations For versions prior to 1.7.84, update to version 1.7.84 or later to resolve the issue. As a temporary workaround, consider restricting the processing of PNG files from untrusted sources until the update is applied.

Correção

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

ALT-PU-2018-2728

AZL-43813

AZL-43846

AZL-43966

AZL-44008

AZL-44265

AZL-44589

AZL-44832

AZL-44913

CVE-2015-2158

MGASA-2015-0101

Produtos afetados

Alt Linux

Pngcrush

Referências · 17

• https://osv.dev/vulnerability/AZL-44008 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-44265 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2158 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-43846 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1198171 · Correção
• https://osv.dev/vulnerability/MGASA-2015-0101 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2015-0101.html · Nota de Segurança
• https://osv.dev/vulnerability/AZL-43966 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/03/01/1 · Correção
• https://osv.dev/vulnerability/AZL-44832 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-44589 · Aviso do Fabricante
• http://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released · Nota
• https://bugs.mageia.org/show_bug.cgi?id=15393 · Nota
• https://osv.dev/vulnerability/AZL-43813 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-44913 · Aviso do Fabricante