PT-2004-1048 · Opensuse · Libpng

Chris Evans · Published 2004-08-05 · Updated 2017-10-11 · CVE-2004-0598

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libpng versions 1.2.5 and earlier

Description The issue concerns multiple vulnerabilities in the libpng package of the openSUSE operating system, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the png handle iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.

Recommendations For libpng versions 1.2.5 and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, consider restricting the use of libpng until a patch is available.

Exploit

Fix

Related Identifiers

BDU:2015-04800

CVE-2004-0598

DSA-536

RHSA-2004:402

Affected Products

Libpng

References · 30

• 🔥 http://securityfocus.com/bid/10857 · Exploit
• 🔥 http://scary.beasts.org/security/CESA-2004-001.txt · Exploit
• http://trustix.net/errata/2004/0040 · Vendor Advisory
• http://lists.apple.com/mhonarc/security-announce/msg00056.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109181639602978&w=2 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200408-03.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-402.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109761239318458&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0598 · Security Note
• http://novell.com/linux/security/advisories/2004_23_libpng.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:079 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04800 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:212 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:213 · Vendor Advisory