The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.

From Red Hat Security Advisory 2007:0356 :

Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A flaw was found in the handling of malformed images in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was opened. (CVE-2006-5793)

Users of libpng should update to these updated packages which contain backported patches to correct these issues.

Red Hat would like to thank Glenn Randers-Pehrson, Mats Palmgren, and Tavis Ormandy for supplying details and patches for these issues.

A flaw was found in the handling of malformed images in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was opened. (CVE-2006-5793)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The sPLT chunk handling in libpng was incorrect and a handcrafted PNG file could be use to cause an out-of-bounds read, effectively crashing the PNG viewer or webbrowser. (CVE-2006-5793)

Additionally a 2 byte stackoverflow was fixed which we do not believe to be exploitable. It will cause an abort of the viewer or webbrowser in SUSE Linux 10.0 and newer due to string overflow checking.
(CVE-2006-3334)

Tavis Ormandy discovered that libpng did not correctly calculate the size of sPLT structures when reading an image. By tricking a user or an automated system into processing a specially crafted PNG file, an attacker could exploit this weakness to crash the application using the library.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The sPLT chunk handling in libpng was incorrect and a handcrafted PNG file could be use to cause an out-of-bounds read, effectively crashing the PNG viewer or webbrowser. (CVE-2006-5793)

Additionaly a 2 byte stackoverflow was fixed which we do not believe to be exploitable. It will cause an abort of the viewer or webbrowser in SUSE Linux 10.0 and newer due to string overflow checking.
(CVE-2006-3334)

Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A flaw was found in the handling of malformed images in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was opened. (CVE-2006-5793)

Users of libpng should update to these updated packages which contain backported patches to correct these issues.

Red Hat would like to thank Glenn Randers-Pehrson, Mats Palmgren, and Tavis Ormandy for supplying details and patches for these issues.

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security issues.

Doxygen is a documentation system for C, C++ and IDL. It is built with a private copy of libpng, and as such could be susceptible to some of the same vulnerabilities :

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to 'chunk error processing,' possibly involving the 'chunk_name'. (CVE-2006-3334)

It is questionable whether this issue is actually exploitable, but the patch to correct the issue has been included in versions < 1.2.12.

Tavis Ormandy, of the Gentoo Linux Security Auditing Team, discovered a typo in png_set_sPLT() that may cause an application using libpng to read out of bounds, resulting in a crash. (CVE-2006-5793)

In addition, an patch to address several old vulnerabilities has been applied to this build. (CVE-2002-1363, CVE-2004-0421, CVE-2004-0597, CVE-2004-0598, CVE-2004-0599)

Packages have been patched to correct these issues.

PXELINUX is a PXE bootloader. It is built with a private copy of libpng, and as such could be susceptible to some of the same vulnerabilities :

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to 'chunk error processing,' possibly involving the 'chunk_name'. (CVE-2006-3334)

It is questionable whether this issue is actually exploitable, but the patch to correct the issue has been included in versions < 1.2.12.

Tavis Ormandy, of the Gentoo Linux Security Auditing Team, discovered a typo in png_set_sPLT() that may cause an application using libpng to read out of bounds, resulting in a crash. (CVE-2006-5793)

Packages have been patched to correct these issues.

SYSLINUX is a boot loader for the Linux operating system which operates off an MS-DOS/Windows FAT filesystem. It is built with a private copy of libpng, and as such could be susceptible to some of the same vulnerabilities :

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to 'chunk error processing,' possibly involving the 'chunk_name'. (CVE-2006-3334)

It is questionable whether this issue is actually exploitable, but the patch to correct the issue has been included in versions < 1.2.12.

Tavis Ormandy, of the Gentoo Linux Security Auditing Team, discovered a typo in png_set_sPLT() that may cause an application using libpng to read out of bounds, resulting in a crash. (CVE-2006-5793)

Packages have been patched to correct these issues.

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to 'chunk error processing,' possibly involving the 'chunk_name'. (CVE-2006-3334)

It is questionable whether this issue is actually exploitable, but the patch to correct the issue has been included in versions < 1.2.12.

Tavis Ormandy, of the Gentoo Linux Security Auditing Team, discovered a typo in png_set_sPLT() that may cause an application using libpng to read out of bounds, resulting in a crash. (CVE-2006-5793)

Packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200611-09 (libpng: Denial of Service)

    Tavis Ormandy of the Gentoo Linux Security Audit Team discovered that a     vulnerability exists in the sPLT chunk handling code of libpng, a large     sPLT chunk may cause an application to attempt to read out of bounds.
  Impact :

    A remote attacker could craft an image that when processed or viewed by     an application using libpng causes the application to terminate     abnormally.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
67500	Oracle Linux 3 / 4 / 5 : libpng (ELSA-2007-0356)	Nessus	Oracle Linux Local Security Checks	medium
60184	Scientific Linux Security Update : libpng on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
29507	SuSE 10 Security Update : libpng (ZYPP Patch Number 2325)	Nessus	SuSE Local Security Checks	high
27966	Ubuntu 5.10 / 6.06 LTS / 6.10 : libpng vulnerability (USN-383-1)	Nessus	Ubuntu Local Security Checks	low
27329	openSUSE 10 Security Update : libpng (libpng-2322)	Nessus	SuSE Local Security Checks	high
25269	RHEL 2.1 / 3 / 4 / 5 : libpng (RHSA-2007:0356)	Nessus	Red Hat Local Security Checks	medium
25256	CentOS 3 / 4 / 5 : libpng (CESA-2007:0356)	Nessus	CentOS Local Security Checks	medium
24661	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 : libpng (SSA:2006-335-03)	Nessus	Slackware Local Security Checks	low
24597	Mandrake Linux Security Advisory : doxygen (MDKSA-2006:212)	Nessus	Mandriva Local Security Checks	critical
24596	Mandrake Linux Security Advisory : pxelinux (MDKSA-2006:211)	Nessus	Mandriva Local Security Checks	high
24595	Mandrake Linux Security Advisory : syslinux (MDKSA-2006:210)	Nessus	Mandriva Local Security Checks	high
24594	Mandrake Linux Security Advisory : libpng (MDKSA-2006:209)	Nessus	Mandriva Local Security Checks	high
23674	GLSA-200611-09 : libpng: Denial of Service	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2006-5793

high

Tenable Plugins

medium

medium

critical

high

low

high

medium

medium

low

critical

high

high

high

low