The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.

Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690, CVE-2011-2691, CVE-2011-2692

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a 1-byte uninitialized memory reference in png_format_buffer(). It allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. This is CVE-2011-2501.

Also fixed in this release are some other minor security problems and there's additionally a bugfix backported from 1.5.3: when expanding a paletted image, always expand to RGBA if transparency is present.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2011-2501.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Steve Grubb reports a buffer read overrun in libpng's png_format_buffer function. A specially constructed PNG image processed by an application using libpng may trigger the buffer read overrun and possibly result in an application crash.

Chromium is an OpenGL-based shoot them up game with fine graphics. It is built with a private copy of libpng, and as such could be susceptible to some of the same vulnerabilities :

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to 'chunk error processing,' possibly involving the 'chunk_name'. (CVE-2006-3334)

It is questionable whether this issue is actually exploitable, but the patch to correct the issue has been included in versions < 1.2.12.

In addition, an patch to address several old vulnerabilities has been applied to this build. (CVE-2002-1363, CVE-2004-0421, CVE-2004-0597, CVE-2004-0598, CVE-2004-0599)

Packages have been patched to correct these issues.

Doxygen is a documentation system for C, C++ and IDL. It is built with a private copy of libpng, and as such could be susceptible to some of the same vulnerabilities :

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to 'chunk error processing,' possibly involving the 'chunk_name'. (CVE-2006-3334)

It is questionable whether this issue is actually exploitable, but the patch to correct the issue has been included in versions < 1.2.12.

Tavis Ormandy, of the Gentoo Linux Security Auditing Team, discovered a typo in png_set_sPLT() that may cause an application using libpng to read out of bounds, resulting in a crash. (CVE-2006-5793)

In addition, an patch to address several old vulnerabilities has been applied to this build. (CVE-2002-1363, CVE-2004-0421, CVE-2004-0597, CVE-2004-0598, CVE-2004-0599)

Packages have been patched to correct these issues.

New libpng packages are available for Slackware 9.0, 9.1, and
-current to fix an issue where libpng could be caused to crash, perhaps creating a denial of service issue if network services are linked with it.

Steve Grubb discovered a problem in the Portable Network Graphics library libpng which is utilised in several applications. When processing a broken PNG image, the error handling routine will access memory that is out of bounds when creating an error message. Depending on machine architecture, bounds checking and other protective measures, this problem could cause the program to crash if a defective or intentionally prepared PNG image file is handled by libpng.

This could be used as a denial of service attack against various programs that link against this library. The following commands will show you which packages utilise this library and whose programs should probably restarted after an upgrade :

    apt-cache showpkg libpng2 apt-cache showpkg libpng3

The following security matrix explains which package versions will contain a correction.

  Package            stable (woody)     unstable (sid)       libpng             1.0.12-3.woody.5   1.0.15-5             libpng3            1.2.1-1.1.woody.5  1.2.5.0-6

The remote host is affected by the vulnerability described in GLSA-200405-06 (libpng denial of service vulnerability)

    libpng provides two functions (png_chunk_error and png_chunk_warning) for     default error and warning messages handling. These functions do not perform     proper bounds checking on the provided message, which is limited to 64     bytes. Programs linked against this library may crash when handling a     malicious PNG image.
  Impact :

    This vulnerability could be used to crash various programs using the libpng     library, potentially resulting in a denial of service attack on vulnerable     daemon processes.
  Workaround :

    There is no known workaround at this time. All users are advised to upgrade     to the latest available version of libpng.

The remote host is missing Security Update 2004-08-09.

libpng is a library used for manipulating graphics files.  Several buffer overflows have been discovered in libpng.  A remote attacker could exploit these vulnerabilities by tricking a user into opening a maliciously crafted PNG file, resulting in the execution of arbitrary code.

Steve Grubb discovered that libpng would access memory that is out of bounds when creating an error message. The impact of this bug is not clear, but it could lead to a core dump in a program using libpng, or could result in a DoS (Denial of Service) condition in a daemon that uses libpng to process PNG imagaes.

The updated packages are patched to correct the vulnerability.

- Mon Apr 19 2004 Matthias Clasen <mclasen at redhat.com>

  - fix a possible out-of-bounds read in the error message     handler. #121229

  - Tue Mar 02 2004 Elliot Lee <sopwith at redhat.com>

  - rebuilt

  - Fri Feb 13 2004 Elliot Lee <sopwith at redhat.com>

  - rebuilt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Apr 19 2004 Matthias Clasen <mclasen at redhat.com>

  - fix a possible out-of-bounds read in the error message     handler. #121229

  - Tue Mar 02 2004 Elliot Lee <sopwith at redhat.com>

  - rebuilt

  - Fri Feb 27 2004 Mark McLoughlin <markmc at redhat.com>     2:1.2.2-19

  - rebuild with changed bits/setjmp.h on ppc

  - Fri Feb 13 2004 Elliot Lee <sopwith at redhat.com>

  - rebuilt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libpng packages that fix a out of bounds memory access are now available.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

Steve Grubb discovered a out of bounds memory access flaw in libpng.
An attacker could carefully craft a PNG file in such a way that it would cause an application linked to libpng to crash when opened by a victim. This issue may not be used to execute arbitrary code.

Users are advised to upgrade to these updated packages that contain a backported security fix not vulnerable to this issue.

ID	Name	Product	Family	Severity
55738	Fedora 14 : libpng-1.2.46-1.fc14 (2011-9336)	Nessus	Fedora Local Security Checks	medium
55655	Fedora 14 : libpng10-1.0.55-1.fc14 (2011-8867)	Nessus	Fedora Local Security Checks	medium
55654	Fedora 15 : libpng10-1.0.55-1.fc15 (2011-8844)	Nessus	Fedora Local Security Checks	medium
55612	Fedora 15 : libpng-1.2.46-1.fc15 (2011-9343)	Nessus	Fedora Local Security Checks	medium
55600	Fedora 15 : mingw32-libpng-1.4.3-3.fc15 (2011-8874)	Nessus	Fedora Local Security Checks	medium
55599	Fedora 14 : mingw32-libpng-1.4.3-2.fc14 (2011-8868)	Nessus	Fedora Local Security Checks	medium
37799	FreeBSD : libpng denial-of-service (3a408f6f-9c52-11d8-9366-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	medium
24598	Mandrake Linux Security Advisory : chromium (MDKSA-2006:213)	Nessus	Mandriva Local Security Checks	critical
24597	Mandrake Linux Security Advisory : doxygen (MDKSA-2006:212)	Nessus	Mandriva Local Security Checks	critical
18751	Slackware 9.0 / 9.1 / current : libpng update (SSA:2004-124-04)	Nessus	Slackware Local Security Checks	medium
15335	Debian DSA-498-1 : libpng - out of bound access	Nessus	Debian Local Security Checks	medium
14492	GLSA-200405-06 : libpng denial of service vulnerability	Nessus	Gentoo Local Security Checks	medium
14242	Mac OS X Multiple Vulnerabilities (Security Update 2004-08-09)	Nessus	MacOS X Local Security Checks	medium
14139	Mandrake Linux Security Advisory : libpng (MDKSA-2004:040)	Nessus	Mandriva Local Security Checks	medium
13689	Fedora Core 1 : libpng10-1.0.13-11 (2004-106)	Nessus	Fedora Local Security Checks	medium
13688	Fedora Core 1 : libpng-1.2.2-20 (2004-105)	Nessus	Fedora Local Security Checks	medium
12492	RHEL 2.1 / 3 : libpng (RHSA-2004:180)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2004-0421

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium