PT-2016-5054 · Open Source+1 · Optipng+1

Hans Jerry Illikainen · Published 2016-04-07 · Updated 2024-06-15 · CVE-2016-2191

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OptiPNG versions prior to 0.7.6

Description The issue allows remote attackers to cause a denial of service, resulting in an invalid memory write and crash. This is achieved through a series of delta escapes in a crafted BMP image, specifically targeting the bmp read rows function in pnxtern/pngxrbmp.c.

Recommendations For versions prior to 0.7.6, update to version 0.7.6 or later to resolve the issue. As a temporary workaround, consider restricting the processing of BMP images from untrusted sources until the update is applied.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-2191

DSA-3546-1

MGASA-2016-0135

OPENSUSE-SU-2024:10140-1

USN-2951-1

Affected Products

Optipng

Ubuntu

References · 31

• 🔥 http://packetstormsecurity.com/files/136553/Optipng-Invalid-Write.html · Exploit
• https://ubuntu.com/security/CVE-2016-2191 · Vendor Advisory
• http://ubuntu.com/usn/USN-2951-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2951-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3546-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2191 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7801 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3982 · Vendor Advisory
• https://sourceforge.net/p/optipng/bugs/59 · Patch
• https://osv.dev/vulnerability/MGASA-2016-0135 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0135.html · Security Note
• https://ubuntu.com/security/CVE-2015-7802 · Vendor Advisory
• https://security.gentoo.org/glsa/201608-01 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2191 · Vendor Advisory