PT-2018-7112 · Bpg+1 · Libbpg+1

Published 2018-08-22 · Updated 2019-10-09 · CVE-2017-2575

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: libbpg version 0.9.7

Description: A NULL pointer dereference issue was discovered in the BPG encoder due to a missing check of the return value of the malloc function. This issue occurs when converting a malicious JPEG file to BPG.

Recommendations: For libbpg version 0.9.7, consider adding a check for the return value of the malloc function in the BPG encoder to prevent NULL pointer dereferences. As a temporary workaround, restrict the conversion of untrusted JPEG files to BPG until a patch is available.

Fix

Buffer Overflow

NULL Pointer Dereference

Weakness Enumeration

CWE-119

CWE-476

Related Identifiers

ALT-PU-2019-1439

CVE-2017-2575

Affected Products

Alt Linux

Libbpg

References · 5

• https://osv.dev/vulnerability/CVE-2017-2575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2575 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148857 · Note
• http://securityfocus.com/bid/97963 · Note
• http://seclists.org/oss-sec/2017/q2/100 · Note