PT-2014-1891 · Libpng+2 · Libpng+2

Published 2014-05-06 · Updated 2025-06-09 · CVE-2013-7354

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libpng versions prior to 1.6.10 libpng versions prior to 1.5.14rc03

Description The issue concerns multiple integer overflows in libpng that can be exploited remotely, leading to a denial of service (crash) due to a heap-based buffer overflow. This can occur when a crafted image is processed by the png set sPLT or png set text 2 function.

Recommendations For libpng versions prior to 1.6.10, update to version 1.6.10 or later. For libpng versions prior to 1.5.14rc03, update to version 1.5.14rc03 or later. As a temporary workaround, consider restricting the use of the png set sPLT and png set text 2 functions until a patch is available.

Fix

DoS

Heap Based Buffer Overflow

Integer Overflow

Weakness Enumeration

CWE-122

CWE-190

CWE-189

Related Identifiers

ALT-PU-2014-2488

BDU:2015-09756

CVE-2013-7354

MGASA-2014-0210

MGASA-2014-0211

OPENSUSE-SU-2024:10184-1

Affected Products

Alt Linux

Suse

Libpng

References · 29

• https://advisories.mageia.org/MGASA-2014-0210.html · Security Note
• https://bdu.fstec.ru/vul/2016-01662 · Security Note
• https://osv.dev/vulnerability/CVE-2013-7354 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0211 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-7354 · Vendor Advisory
• http://sourceforge.net/p/libpng/bugs/199 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0210 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-2488 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-05/msg00015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0973 · Security Note
• https://bdu.fstec.ru/vul/2016-01663 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7354 · Security Note
• https://advisories.mageia.org/MGASA-2014-0211.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7353 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9495 · Security Note