Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length. NOTE: this is due to an incomplete fix for CVE-2006-7244.

This update of libpng14-14 fixes :

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng12-0 fixes :

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

The remote host is affected by the vulnerability described in GLSA-201206-15 (libpng: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libpng:
      The &ldquo;embedded_profile_len()&rdquo; function in pngwutil.c does not         check for negative values, resulting in a memory leak (CVE-2009-5063).
      The &ldquo;png_format_buffer()&rdquo; function in pngerror.c contains an         off-by-one error (CVE-2011-2501).
      The &ldquo;png_rgb_to_gray()&rdquo; function in pngrtran.c contains an         integer overflow error (CVE-2011-2690).
      The &ldquo;png_err()&rdquo; function in pngerror.c contains a NULL pointer         dereference error (CVE-2011-2691).
      The &ldquo;png_handle_sCAL()&rdquo; function in pngrutil.c improperly handles         malformed sCAL chunks(CVE-2011-2692).
      The &ldquo;png_decompress_chunk()&rdquo; function in pngrutil.c contains an         integer overflow error (CVE-2011-3026).
      The &ldquo;png_inflate()&rdquo; function in pngrutil.c contains and out of         bounds error (CVE-2011-3045).
      The &ldquo;png_set_text_2()&rdquo; function in pngset.c contains an error         which could result in memory corruption (CVE-2011-3048).
      The &ldquo;png_formatted_warning()&rdquo; function in pngerror.c contains an         off-by-one error (CVE-2011-3464).
  Impact :

    An attacker could exploit these vulnerabilities to execute arbitrary       code with the permissions of the user running the vulnerable program,       which could be the root user, or to cause programs linked against the       library to crash.
  Workaround :

    There is no known workaround at this time.

It was discovered that libpng did not properly verify the embedded profile length of iCCP chunks. An attacker could exploit this to cause a denial of service via application crash. This issue only affected Ubuntu 8.04 LTS. (CVE-2009-5063)

Jueri Aedla discovered that libpng did not properly verify the size used when allocating memory during chunk decompression. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or execute code with the privileges of the user invoking the program. (CVE-2011-3026).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of libpng fixes :

  - CVE-2008-6218: CVSS v2 Base Score: 7.1     (AV:N/AC:M/Au:N/C:N/I:N/A:C): Resource Management Errors     (CWE-399)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng12-0 fixes :

  - CVE-2008-6218: CVSS v2 Base Score: 7.1     (AV:N/AC:M/Au:N/C:N/I:N/A:C): Resource Management Errors     (CWE-399)

  - unknown (unknown). (CVE-2009-5063: CVSS v2 Base Score:
    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P))

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng fixes :

  - CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C):
    Resource Management Errors (CWE-399). (CVE-2008-6218)

  - CVSS v2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P):
    Buffer Errors (CWE-119). (CVE-2011-2690)

  - CVSS v2 Base Score: 5.0 (AV:N/AC:M/Au:N/C:N/I:N/A:P):
    Buffer Errors (CWE-119). (CVE-2011-2692)

ID	Name	Product	Family	Severity
75913	openSUSE Security Update : libpng14 (libpng14-4949)	Nessus	SuSE Local Security Checks	high
75911	openSUSE Security Update : libpng12 (libpng12-4947)	Nessus	SuSE Local Security Checks	high
75604	openSUSE Security Update : libpng14 (libpng14-4949)	Nessus	SuSE Local Security Checks	high
75603	openSUSE Security Update : libpng12 (libpng12-4947)	Nessus	SuSE Local Security Checks	high
59668	GLSA-201206-15 : libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57998	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : libpng vulnerabilities (USN-1367-1)	Nessus	Ubuntu Local Security Checks	high
57218	SuSE 10 Security Update : libpng (ZYPP Patch Number 7670)	Nessus	SuSE Local Security Checks	high
55897	SuSE 10 Security Update : libpng (ZYPP Patch Number 7669)	Nessus	SuSE Local Security Checks	high
55896	SuSE 11.1 Security Update : libpng (SAT Patch Number 4948)	Nessus	SuSE Local Security Checks	high
55895	SuSE9 Security Update : libpng (YOU Patch Number 12815)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-5063

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high