PT-2007-1120 · Libpng+1 · Libpng+1
Published
2007-10-08
·
Updated
2018-10-15
·
CVE-2007-5269
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions:
libpng versions prior to 1.0.29
libpng versions 1.2.x prior to 1.2.21
Description:
The issue allows remote attackers to cause a denial of service (crash) via crafted chunking in PNG images, specifically in (1) pCAL, (2) sCAL, (3) tEXt, (4) iTXt, and (5) ztXT chunks, which trigger out-of-bounds read operations. This can lead to disruption of protected information.
Recommendations:
For libpng versions prior to 1.0.29, update to version 1.0.29 or later.
For libpng versions 1.2.x prior to 1.2.21, update to version 1.2.21 or later.
As a temporary workaround, consider restricting the use of
png handle pCAL, png handle sCAL, png push read tEXt, png handle iTXt, and png handle ztXt functions until a patch is available.Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Libpng