PT-2002-1065 · Libpng · Libpng

Published 2002-07-26 · Updated 2008-09-05 · CVE-2002-0728

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libpng versions 1.0.x before 1.0.14 libpng versions 1.2.x before 1.2.4

Description The issue affects the libpng package, allowing remote exploitation that may lead to a violation of confidentiality, integrity, and availability of protected information. A buffer overflow in the progressive reader for libpng can be triggered by a PNG data stream with more IDAT data than indicated by the IHDR chunk, causing a denial of service (crash).

Recommendations For libpng versions 1.0.x before 1.0.14, update to version 1.0.14 or later to resolve the issue. For libpng versions 1.2.x before 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of libpng until a patch is available.

Fix

Related Identifiers

BDU:2015-08153

BDU:2015-08154

CVE-2002-0728

DSA-140

Affected Products

Libpng

References · 9

• http://linux-mandrake.com/en/security/2002/MDKSA-2002-049.php · Vendor Advisory
• http://debian.org/security/2002/dsa-140 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08154 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2002-0728 · Security Note
• http://rhn.redhat.com/errata/RHSA-2002-152.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000512 · Vendor Advisory
• ftp://swrinde.nde.swri.edu/pub/png-group/archives/png-list.200207 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08153 · Security Note
• https://rhn.redhat.com/errata/RHSA-2003-006.html · Note