PT-2009-1051 · Libpng+2 · Libpng+2
Tavis Ormandy
·
Published
2009-02-22
·
Updated
2024-12-12
·
CVE-2009-0040
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libpng versions prior to 1.0.43
libpng versions 1.2.x prior to 1.2.35
libpng10-devel version 1.0.13
libpng10 version 1.0.13
libpng-devel versions 1.0.14 and 1.2.2
libpng versions 1.0.14 and 1.2.2
Description
The issue allows context-dependent attackers to cause a denial of service or possibly execute arbitrary code via a crafted PNG file. This can lead to a disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely. The vulnerability is triggered by a free of an uninitialized pointer in functions such as
png read png, pCAL chunk handling, or setup of 16-bit gamma tables.Recommendations
For libpng versions prior to 1.0.43, update to version 1.0.43 or later.
For libpng versions 1.2.x prior to 1.2.35, update to version 1.2.35 or later.
For libpng10-devel version 1.0.13, update to a version later than 1.0.13.
For libpng10 version 1.0.13, update to a version later than 1.0.13.
For libpng-devel versions 1.0.14 and 1.2.2, update to versions later than 1.0.14 and 1.2.2 respectively.
For libpng versions 1.0.14 and 1.2.2, update to versions later than 1.0.14 and 1.2.2 respectively.
As a temporary workaround, consider disabling the
png read png function and avoiding the use of pCAL chunk handling and setup of 16-bit gamma tables until a patch is available. Restrict access to libpng modules to minimize the risk of exploitation. Avoid using crafted PNG files in affected API endpoints until the issue is resolved.Exploit
Fix
DoS
Access of Uninitialized Pointer
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Suse
Libpng