PT-2015-3261 · Libpng+5 · Libpng+5
Padma81
·
Published
2015-12-11
·
Updated
2024-09-06
·
CVE-2015-8540
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libpng versions 0.90 through 0.99
libpng versions 1.0.x before 1.0.66
libpng versions 1.1.x and 1.2.x before 1.2.56
libpng versions 1.3.x and 1.4.x before 1.4.19
libpng versions 1.5.x before 1.5.26
Description
The issue is caused by an integer underflow in the
png check keyword function in pngwutil.c, which allows remote attackers to have an unspecified impact via a space character as a keyword in a PNG image, triggering an out-of-bounds read. This could potentially affect the integrity, availability, and confidentiality of information. The vulnerability may be exploited by sending a specially crafted PNG image with a space character in the keyword.Recommendations
For libpng versions 0.90 through 0.99, update to a version outside of this range to mitigate the issue.
For libpng versions 1.0.x before 1.0.66, update to version 1.0.66 or later.
For libpng versions 1.1.x and 1.2.x before 1.2.56, update to version 1.2.56 or later.
For libpng versions 1.3.x and 1.4.x before 1.4.19, update to version 1.4.19 or later.
For libpng versions 1.5.x before 1.5.26, update to version 1.5.26 or later.
As a temporary workaround, consider restricting the use of PNG images with space characters in keywords until a patch is available.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ibm Aix
Red Hat
Suse
Ubuntu
Libpng