PT-2008-5294 · Libpng · Libpng

Published 2008-09-10 · Updated 2024-06-15 · CVE-2008-3964

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libpng versions prior to 1.2.32beta01 libpng versions 1.4 prior to 1.4.0beta34

Description The issue is related to multiple off-by-one errors in libpng, allowing context-dependent attackers to cause a denial of service or have unspecified other impact via a PNG image with crafted zTXt chunks. This is related to the png push read zTXt function in pngread.c and possibly pngtest.c.

Recommendations For libpng versions prior to 1.2.32beta01, update to version 1.2.32beta01 or later. For libpng versions 1.4 prior to 1.4.0beta34, update to version 1.4.0beta34 or later. As a temporary workaround, consider restricting the use of crafted zTXt chunks in PNG images until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2008-3964

OPENSUSE-SU-2024:10972-1

Affected Products

Libpng

References · 34

• 🔥 http://sourceforge.net/tracker/index.php?func=detail&aid=2095669&group_id=5624&atid=105624 · Exploit
• http://security.gentoo.org/glsa/glsa-200812-15.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3964 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10972-1 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?release_id=624518 · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2009:051 · Vendor Advisory
• http://secunia.com/advisories/35386 · Note
• https://suse.com/security/cve/CVE-2017-12652 · Note
• http://vupen.com/english/advisories/2009/1560 · Note
• https://suse.com/security/cve/CVE-2018-13785 · Note
• https://suse.com/security/cve/CVE-2018-14048 · Note
• https://suse.com/security/cve/CVE-2019-7317 · Note
• http://vupen.com/english/advisories/2009/1462 · Note