PT-2017-17594 · Pngdefry · Pngdefry

Rajullas · Published 2017-03-22 · Updated 2017-03-28 · CVE-2017-7231

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pngdefry versions prior to 2017-03-22

Description The issue is related to a heap-based buffer-overflow vulnerability. This occurs because pngdefry fails to properly process a specially crafted png file, affecting the process() function in the pngdefry.c source file.

Recommendations For versions prior to 2017-03-22, as a temporary workaround, consider disabling the process() function until a patch is available. Restrict access to the pngdefry.c source file to minimize the risk of exploitation. Avoid using pngdefry to process untrusted png files until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-7231

Affected Products

Pngdefry

References · 4

• 🔥 https://github.com/Tatsh/pngdefry/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2017-7231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7231 · Security Note
• http://securityfocus.com/bid/97037 · Note