Off-by-one error in ICC profile chunk handling in the png_set_iCCP function in pngset.c in libpng before 1.2.22 beta1 allows remote attackers to cause a denial of service (crash) via a crafted PNG image, due to an incorrect fix for CVE-2007-5266.

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

New libpng packages are available for Slackware 10.1 and 10.2 that were left out of the last batch of updates.  These fix the same security problems as the other 1.2.23 upgrades.

More details about these issues may be found in the Common Vulnerabilities and Exposures (CVE) database:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5266   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5267   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5268   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5269

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues.

It was discovered that libpng did not properly perform bounds checking and comparisons in certain operations. An attacker could send a specially crafted PNG image and cause a denial of service in applications linked against libpng.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Secunia Advisory reports :

Some vulnerabilities have been reported in libpng, which can be exploited by malicious people to cause a DoS (Denial of Service).

Certain errors within libpng, including a logical NOT instead of a bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency extension, and an incorrect use of sizeof() may be exploited to crash an application using the library.

Various out-of-bounds read errors exist within the functions png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(), png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by exploited to crash an application using the library.

The vulnerability is caused due to an off-by-one error within the ICC profile chunk handling, which potentially can be exploited to crash an application using the library.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.3.  Mac OS X 10.5.3 contains security fixes for a number of programs.

ID	Name	Product	Family	Severity
107983	Solaris 10 (x86) : 137081-10	Nessus	Solaris Local Security Checks	high
107982	Solaris 10 (x86) : 137081-09	Nessus	Solaris Local Security Checks	high
107981	Solaris 10 (x86) : 137081-07	Nessus	Solaris Local Security Checks	high
107485	Solaris 10 (sparc) : 137080-10	Nessus	Solaris Local Security Checks	high
107484	Solaris 10 (sparc) : 137080-09	Nessus	Solaris Local Security Checks	high
107483	Solaris 10 (sparc) : 137080-07	Nessus	Solaris Local Security Checks	high
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
28296	SSA-2007-325-01a libpng for Slackware 10.1 and 10.2	Nessus	Slackware Local Security Checks	medium
28295	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 8.1 / 9.0 / 9.1 / current : libpng (SSA:2007-325-01)	Nessus	Slackware Local Security Checks	medium
28145	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : libpng vulnerabilities (USN-538-1)	Nessus	Ubuntu Local Security Checks	medium
26977	FreeBSD : png -- multiple vulnerabilities (172acf78-780c-11dc-b3f4-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium
4523	Mac OS X < 10.5.3	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2007-5267

medium

Tenable Plugins

high

high

high

high

high

high

critical

medium

medium

medium

medium

critical