PT-2017-6554 · Pngcrush+1 · Pngcrush+1

Vasyl Kaigorodov · Published 2015-03-10 · Updated 2018-11-30 · CVE-2015-2158

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pngcrush versions prior to 1.7.84

Description The issue is caused by an off-by-one error in the pngcrush measure idat function, which can be exploited by remote attackers using a crafted PNG file. This could lead to a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code.

Recommendations For versions prior to 1.7.84, update to version 1.7.84 or later to resolve the issue. As a temporary workaround, consider restricting the processing of PNG files from untrusted sources until the update is applied.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2018-2728

AZL-43813

AZL-43846

AZL-43966

AZL-44008

AZL-44265

AZL-44589

AZL-44832

AZL-44913

CVE-2015-2158

MGASA-2015-0101

Affected Products

Alt Linux

Pngcrush

References · 17

• https://osv.dev/vulnerability/AZL-44008 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2158 · Security Note
• https://osv.dev/vulnerability/AZL-43846 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1198171 · Patch
• https://osv.dev/vulnerability/MGASA-2015-0101 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0101.html · Security Note
• https://osv.dev/vulnerability/AZL-43966 · Vendor Advisory
• http://openwall.com/lists/oss-security/2015/03/01/1 · Patch
• https://osv.dev/vulnerability/AZL-44832 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44589 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43813 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44913 · Vendor Advisory
• https://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released · Patch
• http://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released · Note