PT-2017-14645 · Optipng+1 · Optipng+1

Nelson A. De Oliveira · Published 2017-11-24 · Updated 2024-06-15 · CVE-2017-16938

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OptiPNG version 0.7.6

Description A global buffer overflow allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.

Recommendations For OptiPNG version 0.7.6, consider restricting the use of the LZWReadByte function in the gifread.c file until a patch is available. Avoid processing maliciously crafted GIF format files to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-1888

CVE-2017-16938

DLA-1196-1

DSA-4058-1

MGASA-2017-0447

OPENSUSE-SU-2024:11131-1

Affected Products

Alt Linux

Optipng

References · 20

• https://cve.org/CVERecord?id=CVE-2017-16938 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-16938 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16938 · Vendor Advisory
• https://sourceforge.net/p/optipng/bugs/69 · Patch
• https://security-tracker.debian.org/tracker/CVE-2017-16938 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16938 · Vendor Advisory
• https://security.gentoo.org/glsa/201801-02 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4058-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16938 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16938 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0447 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0447.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11131-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-4058 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=22099 · Note