PT-2012-1187 · Libpng+2 · Libpng+2

Mikulas Patocka · Published 2012-08-13 · Updated 2024-09-06 · CVE-2012-3425

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libpng versions 1.0.x through 1.0.57 libpng versions 1.2.x through 1.2.47 libpng versions 1.4.x through 1.4.9 libpng versions 1.5.x through 1.5.9

Description The issue allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail in field value in a PNG image. This is due to a buffer overflow in the png push read zTXt function.

Recommendations For libpng versions 1.0.x through 1.0.57, update to version 1.0.58 or later. For libpng versions 1.2.x through 1.2.47, update to version 1.2.48 or later. For libpng versions 1.4.x through 1.4.9, update to version 1.4.10 or later. For libpng versions 1.5.x through 1.5.9, update to version 1.5.10 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

AZL-41176

BDU:2016-01668

CVE-2012-3425

DLA-375-1

OESA-2024-2091

SUSE-SU-2012_0989-1

USN-2815-1

Affected Products

Suse

Ubuntu

Libpng

References · 35

• https://ubuntu.com/security/notices/USN-2815-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8126 · Security Note
• https://ubuntu.com/security/CVE-2015-7981 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-41176 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-3425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8472 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-3425 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2501 · Security Note
• http://lists.opensuse.org/opensuse-updates/2012-08/msg00004.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12652 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-3048 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-7981 · Security Note
• https://osv.dev/vulnerability/USN-2815-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3045 · Security Note
• http://ubuntu.com/usn/USN-2815-1 · Vendor Advisory