PT-2010-3194 · Opengl · Glpng

Published 2010-08-13 · Updated 2018-10-10 · CVE-2010-1519

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions glpng version 1.45

Description The issue is related to multiple integer overflows in the glpng.c file, which can be exploited by context-dependent attackers to execute arbitrary code. This is achieved through crafted PNG images, specifically affecting the pngLoadRawF function and the pngLoadF function, leading to heap-based buffer overflows.

Recommendations For glpng version 1.45, consider applying patches or updates that address the integer overflows in the glpng.c file, specifically in the pngLoadRawF and pngLoadF functions, to prevent heap-based buffer overflows. As a temporary workaround, consider restricting the use of glpng to process untrusted PNG images until a patch is available.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-1519

Affected Products

Glpng

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-1519 · Security Note
• http://secunia.com/secunia_research/2010-87 · Vendor Advisory
• http://secunia.com/advisories/40354 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:179 · Vendor Advisory
• http://securityfocus.com/archive/1/513022/100/0/threaded · Note