PT-2007-1118 · Libpng · Libpng

Published 2007-10-08 · Updated 2018-10-26 · CVE-2007-5266

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: libpng versions prior to 1.0.29 beta1 libpng versions 1.2.x prior to 1.2.21 beta1

Description: The issue is related to an off-by-one error in ICC profile chunk handling in the png set iCCP function in pngset.c. This error allows remote attackers to cause a denial of service (crash) via a crafted PNG image that prevents a name field from being NULL terminated. Multiple vulnerabilities in the libpng package can lead to disruption of protected information availability, and exploitation can be done remotely.

Recommendations: For libpng versions prior to 1.0.29 beta1, update to version 1.0.29 beta1 or later. For libpng versions 1.2.x prior to 1.2.21 beta1, update to version 1.2.21 beta1 or later. As a temporary workaround, consider restricting the use of the png set iCCP function until a patch is available.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-09607

CVE-2007-5266

Affected Products

Libpng

References · 36

• https://nvd.nist.gov/vuln/detail/CVE-2007-5266 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:217 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.520323 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09607 · Security Note
• http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200805-07.xml · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200711-08.xml · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0924/references · Note
• http://docs.info.apple.com/article.html?artnum=307562 · Note
• http://vupen.com/english/advisories/2009/1462 · Note
• http://coresecurity.com/?action=item&id=2148 · Note
• http://secunia.com/advisories/27284 · Note