PT-2009-1076 · Libpng · Libpng

Jon Foster · Published 2009-01-15 · Updated 2018-11-08 · CVE-2008-5907

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libpng versions 1.0.0 through 1.0.41 libpng versions 1.2.x through 1.2.33

Description The issue in libpng might allow attackers to set the value of an arbitrary memory location to zero via crafted PNG files with keywords, related to an implicit cast of the '0' character constant to a NULL pointer. This is related to the png check keyword function in pngwutil.c. Multiple vulnerabilities in the libpng package can lead to disruption of protected information and can be exploited remotely.

Recommendations For libpng versions 1.0.0 through 1.0.41, update to version 1.0.42 or later. For libpng versions 1.2.x through 1.2.33, update to version 1.2.34 or later.

Fix

Related Identifiers

BDU:2015-09372

CVE-2008-5907

DSA-1750-1

Affected Products

Libpng

References · 12

• http://debian.org/security/2009/dsa-1750 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09372 · Security Note
• http://security.gentoo.org/glsa/glsa-200903-28.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5907 · Security Note
• http://sourceforge.net/mailarchive/forum.php?thread_name=4B6F0239C13D0245820603C036D180BC79FBAA%40CABOTUKEXCH01.cabot.local&forum_name=png-mng-implement · Note
• http://secunia.com/advisories/34388 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48128 · Note
• http://libpng.sourceforge.net/index.html · Note
• http://openwall.com/lists/oss-security/2009/01/09/1 · Note
• http://secunia.com/advisories/34320 · Note