PT-2007-1119 · Libpng · Libpng

Published 2007-10-08 · Updated 2018-10-26 · CVE-2007-5268

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: libpng versions prior to 1.0.29 libpng versions 1.2.x prior to 1.2.21

Description: The issue is related to the use of logical instead of bitwise operations and incorrect comparisons in the pngrtran.c file of libpng. This might allow remote attackers to cause a denial of service via a crafted PNG image. Multiple vulnerabilities in the libpng package can lead to disruption of protected information availability, and exploitation can be done remotely.

Recommendations: For libpng versions prior to 1.0.29, update to version 1.0.29 or later. For libpng versions 1.2.x prior to 1.2.21, update to version 1.2.21 or later.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-09607

CVE-2007-5268

Affected Products

Libpng

References · 41

• http://mandriva.com/security/advisories?name=MDKSA-2007:217 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.520323 · Vendor Advisory
• http://ubuntu.com/usn/usn-538-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09607 · Security Note
• http://sourceforge.net/mailarchive/forum.php?thread_name=3.0.6.32.20071004082318.012a7628%40mail.comcast.net&forum_name=png-mng-implement · Patch
• http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200805-07.xml · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200711-08.xml · Vendor Advisory
• http://sourceforge.net/mailarchive/message.php?msg_name=e56ccc8f0709140846k24e9a040r81623783b6b1c00f%40mail.gmail.com · Patch
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5268 · Security Note
• http://vupen.com/english/advisories/2008/0924/references · Note
• http://docs.info.apple.com/article.html?artnum=307562 · Note