PT-2016-3254 · Libpng+3 · Libpng+3

Patrick Keshishian · Published 2016-12-29 · Updated 2024-09-06 · CVE-2016-10087

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libpng versions 0.71 through 1.0.66 libpng versions 1.2.x through 1.2.56 libpng versions 1.4.x through 1.4.19 libpng versions 1.5.x through 1.5.27 libpng versions 1.6.x through 1.6.26

Description The issue is related to a null pointer dereference in the png set text 2 function of the libpng library. This can be exploited by a remote attacker to cause a denial of service by loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.

Recommendations For libpng versions 0.71 through 1.0.66, update to version 1.0.67 or later. For libpng versions 1.2.x through 1.2.56, update to version 1.2.57 or later. For libpng versions 1.4.x through 1.4.19, update to version 1.4.20 or later. For libpng versions 1.5.x through 1.5.27, update to version 1.5.28 or later. For libpng versions 1.6.x through 1.6.26, update to version 1.6.27 or later.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2017-1041

ALT-PU-2019-1318

AZL-44325

AZL-44883

BDU:2018-00462

CVE-2016-10087

MGASA-2017-0020

OESA-2024-2091

OPENSUSE-SU-2024:10971-1

OPENSUSE-SU-2024:10972-1

SUSE-SU-2017:0853-1

SUSE-SU-2017:0860-1

SUSE-SU-2017:0901-1

SUSE-SU-2017:0950-1

SUSE-SU-2017_0853-1

USN-3712-1

USN-3712-2

Affected Products

Alt Linux

Suse

Ubuntu

Libpng

References · 68

• https://usn.ubuntu.com/3712-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8126 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10972-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0901-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8472 · Security Note
• https://ubuntu.com/security/CVE-2016-10087 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3425 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2501 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-10087 · Security Note
• https://ubuntu.com/security/notices/USN-3712-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12652 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-3048 · Security Note
• https://osv.dev/vulnerability/USN-3712-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7981 · Security Note
• https://security.gentoo.org/glsa/201701-74 · Vendor Advisory