PT-2009-1077 · Libpng · Libpng

Published 2009-02-20 · Updated 2018-10-11 · CVE-2008-6218

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libpng versions prior to 1.2.33 rc02 libpng versions prior to 1.4.0 beta36 libpng versions prior to 1.2.35

Description The issue is related to a memory leak in the png handle tEXt function in pngrutil.c, which allows context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted PNG file. Multiple vulnerabilities in the libpng package can lead to disruption of protected information availability, and exploitation can be done remotely.

Recommendations For libpng versions prior to 1.2.33 rc02, update to version 1.2.33 rc02 or later. For libpng versions prior to 1.4.0 beta36, update to version 1.4.0 beta36 or later. For libpng versions prior to 1.2.35, update to version 1.2.35 or later.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09372

CVE-2008-6218

DSA-1750-1

Affected Products

Libpng

References · 18

• http://debian.org/security/2009/dsa-1750 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?release_id=635837 · Patch
• https://bdu.fstec.ru/vul/2015-09372 · Security Note
• http://secunia.com/advisories/32418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6218 · Security Note
• http://sourceforge.net/project/shownotes.php?release_id=635463&group_id=5624 · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2010:133 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200903-28.xml · Vendor Advisory
• http://securitytracker.com/id?1021104 · Note
• http://securityfocus.com/archive/1/501767/100/0/threaded · Note
• http://secunia.com/advisories/34388 · Note
• http://vupen.com/english/advisories/2008/2917 · Note
• http://secunia.com/advisories/34320 · Note
• http://secunia.com/advisories/34265 · Note
• http://securityfocus.com/bid/31920 · Note