PT-2011-1186 · Png Development · Libpng

Ludwig Nussel · Published 2011-08-31 · Updated 2020-09-09 · CVE-2009-5063

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libpng versions prior to 1.5.10 libpng versions prior to 1.2.39beta5

Description The issue is related to a memory leak in the embedded profile len function in pngwutil.c, which can be exploited by context-dependent attackers to cause a denial of service, such as a memory leak or segmentation fault, via a JPEG image containing an iCCP chunk with a negative embedded profile length. Multiple vulnerabilities in the libpng package can lead to violations of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For libpng versions prior to 1.2.39beta5, update to version 1.2.39beta5 or later. For libpng versions prior to 1.5.10, update to version 1.5.10 or later.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

AZL-41075

BDU:2015-09650

CVE-2009-5063

Affected Products

Libpng

References · 8

• http://openwall.com/lists/oss-security/2011/03/28/6 · Patch
• http://security.gentoo.org/glsa/glsa-201206-15.xml · Vendor Advisory
• https://osv.dev/vulnerability/AZL-41075 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09650 · Security Note
• http://openwall.com/lists/oss-security/2011/03/22/7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-5063 · Security Note
• http://secunia.com/advisories/49660 · Note
• http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=948ee23a2a400672b1751cfc646a7467741e9b2e#patch18 · Note