PT-2016-1708 · Optipng+2 · Optipng+2

Henri Salo · Published 2016-04-07 · Updated 2021-07-31 · CVE-2016-3982

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OptiPNG versions prior to 0.7.6

Description The issue is caused by an off-by-one error in the bmp rle4 fread function, leading to a heap-based buffer overflow when processing a crafted image file. This can result in a denial of service, such as an out-of-bounds read or write access and crash, or possibly allow remote attackers to execute arbitrary code.

Recommendations For versions prior to 0.7.6, update to version 0.7.6 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the bmp rle4 fread function in the pngxrbmp.c file until a patch is available. Restrict access to crafted image files to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-1375

BDU:2016-01034

CVE-2016-3982

DSA-3546-1

OESA-2021-1288

USN-2951-1

Affected Products

Alt Linux

Optipng

Ubuntu

References · 25

• https://ubuntu.com/security/CVE-2016-2191 · Vendor Advisory
• http://ubuntu.com/usn/USN-2951-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2951-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3546-1 · Vendor Advisory
• http://debian.org/security/2016/dsa-3546 · Vendor Advisory
• https://sourceforge.net/p/optipng/bugs/57 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3982 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7801 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3982 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-3982 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3982 · Security Note
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7802 · Vendor Advisory
• https://security.gentoo.org/glsa/201608-01 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-3982 · Security Note