PT-2004-1049 · Libpng · Libpng

Chris Evans · Published 2004-08-05 · Updated 2017-10-11 · CVE-2004-0599

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libpng versions 1.2.5 and earlier

Description The issue concerns multiple integer overflows in libpng, specifically in the png read png function, png handle sPLT functions, and the progressive display image reading capability. These overflows can be exploited remotely via a malformed PNG image, potentially leading to a denial of service (application crash) and compromising the confidentiality, integrity, and availability of protected information.

Recommendations For libpng versions 1.2.5 and earlier, consider updating to a version that addresses these integer overflows to prevent potential crashes and information compromise. As a temporary workaround, restrict the handling of PNG images from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-04800

CVE-2004-0599

DSA-536

DSA-570-1

DSA-571-1

RHSA-2004:402

Affected Products

Libpng

References · 38

• 🔥 http://securityfocus.com/bid/10857 · Exploit
• http://scary.beasts.org/security/CESA-2004-001.txt · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109181639602978&w=2 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109900315219363&w=2 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:079 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04800 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:212 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:213 · Vendor Advisory
• http://debian.org/security/2004/dsa-571 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200408-22.xml · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856 · Vendor Advisory
• http://debian.org/security/2004/dsa-570 · Vendor Advisory
• http://trustix.net/errata/2004/0040 · Vendor Advisory
• http://lists.apple.com/mhonarc/security-announce/msg00056.html · Vendor Advisory