PT-2015-2752 · Libpng Development Team+6 · Libpng+6
Qixue Xiao
·
Published
2015-10-26
·
Updated
2024-09-06
·
CVE-2015-7981
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
libpng versions 1.0.x through 1.0.63
libpng versions 1.2.x through 1.2.53
libpng versions 1.4.x through 1.4.16
Description
The issue allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read. This is related to the png convert to rfc1123 function in png.c. The vulnerability is also associated with a lack of protection for service data, which can be exploited by a remote attacker using a specially crafted image to access protected information. Additionally, there is a buffer overflow issue caused by a read underflow in png check keyword in pngwutil.c, which can be exploited by sending an overly long argument, potentially allowing a remote attacker to execute arbitrary code on the system or cause the application to crash.
Recommendations
For libpng versions 1.0.x through 1.0.63, update to version 1.0.64 or later.
For libpng versions 1.2.x through 1.2.53, update to version 1.2.54 or later.
For libpng versions 1.4.x through 1.4.16, update to version 1.4.17 or later.
As a temporary workaround, consider restricting the use of the
png convert to rfc1123 function and the png check keyword function in pngwutil.c until a patch is available. Avoid using overly long arguments in the png check keyword function to minimize the risk of exploitation.Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Ibm Aix
Red Hat
Suse
Ubuntu
Libpng