Memory leak in the png_handle_tEXt function in pngrutil.c in libpng before 1.2.33 rc02 and 1.4.0 beta36 allows context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted PNG file.

The remote host is affected by the vulnerability described in GLSA-201412-08 (Multiple packages, Multiple vulnerabilities fixed in 2010)

    Vulnerabilities have been discovered in the packages listed below.
      Please review the CVE identifiers in the Reference section for details.
      Insight       Perl Tk Module       Source-Navigator       Tk       Partimage       Mlmmj       acl       Xinit       gzip       ncompress       liblzw       splashutils       GNU M4       KDE Display Manager       GTK+       KGet       dvipng       Beanstalk       Policy Mount       pam_krb5       GNU gv       LFTP       Uzbl       Slim       Bitdefender Console       iputils       DVBStreamer   Impact :

    A context-dependent attacker may be able to gain escalated privileges,       execute arbitrary code, cause Denial of Service, obtain sensitive       information, or otherwise bypass security restrictions.
  Workaround :

    There are no known workarounds at this time.

This update of libpng14-14 fixes :

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng12-0 fixes :

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng fixes :

  - CVE-2008-6218: CVSS v2 Base Score: 7.1     (AV:N/AC:M/Au:N/C:N/I:N/A:C): Resource Management Errors     (CWE-399)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng12-0 fixes :

  - CVE-2008-6218: CVSS v2 Base Score: 7.1     (AV:N/AC:M/Au:N/C:N/I:N/A:C): Resource Management Errors     (CWE-399)

  - unknown (unknown). (CVE-2009-5063: CVSS v2 Base Score:
    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P))

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng fixes :

  - CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C):
    Resource Management Errors (CWE-399). (CVE-2008-6218)

  - CVSS v2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P):
    Buffer Errors (CWE-119). (CVE-2011-2690)

  - CVSS v2 Base Score: 5.0 (AV:N/AC:M/Au:N/C:N/I:N/A:P):
    Buffer Errors (CWE-119). (CVE-2011-2692)

Multiple vulnerabilities has been found and corrected in libpng :

Memory leak in the png_handle_tEXt function in pngrutil.c in libpng before 1.2.33 rc02 and 1.4.0 beta36 allows context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted PNG file (CVE-2008-6218.

Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row (CVE-2010-1205).

Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks (CVE-2010-2249).

As a precaution htmldoc has been rebuilt to link against the system libpng library for CS4 and 2008.0. Latest xulrunner and mozilla-thunderbird has been patched as a precaution for 2008.0 wheres on 2009.0 and up the the system libpng library is used instead of the bundled copy. htmldoc, xulrunner and mozilla-thunderbird packages is therefore also being provided with this advisory.

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

Several vulnerabilities have been discovered in libpng, a library for reading and writing PNG files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2445     The png_handle_tRNS function allows attackers to cause a     denial of service (application crash) via a grayscale     PNG image with a bad tRNS chunk CRC value.

  - CVE-2007-5269     Certain chunk handlers allow attackers to cause a denial     of service (crash) via crafted pCAL, sCAL, tEXt, iTXt,     and ztXT chunking in PNG images, which trigger     out-of-bounds read operations.

  - CVE-2008-1382     libpng allows context-dependent attackers to cause a     denial of service (crash) and possibly execute arbitrary     code via a PNG file with zero length 'unknown' chunks,     which trigger an access of uninitialized memory.

  - CVE-2008-5907     The png_check_keyword might allow context-dependent     attackers to set the value of an arbitrary memory     location to zero via vectors involving creation of     crafted PNG files with keywords.

  - CVE-2008-6218     A memory leak in the png_handle_tEXt function allows     context-dependent attackers to cause a denial of service     (memory exhaustion) via a crafted PNG file.

  - CVE-2009-0040     libpng allows context-dependent attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted PNG file that     triggers a free of an uninitialized pointer in (1) the     png_read_png function, (2) pCAL chunk handling, or (3)     setup of 16-bit gamma tables.

The remote host is affected by the vulnerability described in GLSA-200903-28 (libpng: Multiple vulnerabilities)

    Multiple vulnerabilities were discovered in libpng:
    A     memory leak bug was reported in png_handle_tEXt(), a function that is     used while reading PNG images (CVE-2008-6218).
    A memory     overwrite bug was reported by Jon Foster in png_check_keyword(), caused     by writing overlong keywords to a PNG file (CVE-2008-5907).
    A     memory corruption issue, caused by an incorrect handling of an out of     memory condition has been reported by Tavis Ormandy of the Google     Security Team. That vulnerability affects direct uses of     png_read_png(), pCAL chunk and 16-bit gamma table handling     (CVE-2009-0040).
  Impact :

    A remote attacker may execute arbitrary code with the privileges of the     user opening a specially crafted PNG file by exploiting the erroneous     out-of-memory handling. An attacker may also exploit the     png_check_keyword() error to set arbitrary memory locations to 0, if     the application allows overlong, user-controlled keywords when writing     PNG files. The png_handle_tEXT() vulnerability may be exploited by an     attacker to potentially consume all memory on a users system when a     specially crafted PNG file is opened.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
79961	GLSA-201412-08 : Multiple packages, Multiple vulnerabilities fixed in 2010	Nessus	Gentoo Local Security Checks	critical
75913	openSUSE Security Update : libpng14 (libpng14-4949)	Nessus	SuSE Local Security Checks	high
75911	openSUSE Security Update : libpng12 (libpng12-4947)	Nessus	SuSE Local Security Checks	high
75604	openSUSE Security Update : libpng14 (libpng14-4949)	Nessus	SuSE Local Security Checks	high
75603	openSUSE Security Update : libpng12 (libpng12-4947)	Nessus	SuSE Local Security Checks	high
57218	SuSE 10 Security Update : libpng (ZYPP Patch Number 7670)	Nessus	SuSE Local Security Checks	high
55897	SuSE 10 Security Update : libpng (ZYPP Patch Number 7669)	Nessus	SuSE Local Security Checks	high
55896	SuSE 11.1 Security Update : libpng (SAT Patch Number 4948)	Nessus	SuSE Local Security Checks	high
55895	SuSE9 Security Update : libpng (YOU Patch Number 12815)	Nessus	SuSE Local Security Checks	high
48192	Mandriva Linux Security Advisory : libpng (MDVSA-2010:133)	Nessus	Mandriva Local Security Checks	high
35988	Debian DSA-1750-1 : libpng - several vulnerabilities	Nessus	Debian Local Security Checks	high
35929	GLSA-200903-28 : libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2008-6218

medium

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high