PT-2017-4283 · Png Development+6 · Libpng+6

Published 2017-08-04 · Updated 2024-09-06 · CVE-2017-12652

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: libpng versions prior to 1.6.32

Description: The issue is related to insufficient input validation in the libpng library, which can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The problem arises from the library's failure to properly check the length of chunks against the user limit.

Recommendations: For versions prior to 1.6.32, update to version 1.6.32 or later to resolve the issue. As a temporary workaround, consider restricting the use of libpng until a patch is applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-2451

AZL-43468

AZL-43573

AZL-44469

AZL-44973

AZL-45045

AZL-45102

BDU:2023-07738

CESA-2020_3901

CVE-2017-12652

OESA-2024-2091

OPENSUSE-SU-2024:10971-1

OPENSUSE-SU-2024:10972-1

RHSA-2020:3901

RHSA-2020_3901

SUSE-SU-2019:3060-2

SUSE-SU-2019_3060-1

SUSE-SU-2019_3060-2

SUSE-SU-2020:0911-1

SUSE-SU-2020_0911-1

SUSE-SU-2023:3799-1

SUSE-SU-2023_3799-1

SUSE-SU-2026:1716-1

USN-5432-1

USN-5432-2

Affected Products

Alt Linux

Astra Linux

Centos

Red Hat

Suse

Ubuntu

Libpng

References · 71

• https://ubuntu.com/security/notices/USN-5432-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2691 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10972-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12652 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2690 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12652 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-45102 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07738 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-12652 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5432-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2692 · Security Note
• https://ubuntu.com/security/CVE-2018-14048 · Vendor Advisory