Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.

According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Multiple integer overflows in libpng before 1.5.14rc03     allow remote attackers to cause a denial of service     (crash) via a crafted image to the (1) png_set_sPLT or     (2) png_set_text_2 function, which triggers a     heap-based buffer overflow.(CVE-2013-7354)

  - Integer overflow in the png_set_unknown_chunks function     in libpng/pngset.c in libpng before 1.5.14beta08 allows     context-dependent attackers to cause a denial of     service (segmentation fault and crash) via a crafted     image, which triggers a heap-based buffer     overflow.(CVE-2013-7353)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libpng package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Multiple integer overflows in libpng before 1.5.14rc03     allow remote attackers to cause a denial of service     (crash) via a crafted image to the (1) png_set_sPLT or     (2) png_set_text_2 function, which triggers a     heap-based buffer overflow.(CVE-2013-7354)

  - Integer overflow in the png_set_unknown_chunks function     in libpng/pngset.c in libpng before 1.5.14beta08 allows     context-dependent attackers to cause a denial of     service (segmentation fault and crash) via a crafted     image, which triggers a heap-based buffer     overflow.(CVE-2013-7353)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in the png_set_unknown_chunks function     in libpng/pngset.c in libpng before 1.5.14beta08 allows     context-dependent attackers to cause a denial of     service (segmentation fault and crash) via a crafted     image, which triggers a heap-based buffer     overflow.(CVE-2013-7353)

  - Multiple integer overflows in libpng before 1.5.14rc03     allow remote attackers to cause a denial of service     (crash) via a crafted image to the (1) png_set_sPLT or     (2) png_set_text_2 function, which triggers a     heap-based buffer overflow.(CVE-2013-7354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libpng12 package fixes security vulnerabilities :

The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PLTE chunk of zero bytes or a NULL palette, related to pngrtran.c and pngset.c (CVE-2013-6954).

An integer overflow leading to a heap-based buffer overflow was found in the png_set_sPLT() and png_set_text_2() API functions of libpng. An attacker could create a specially crafted image file and render it with an application written to explicitly call png_set_sPLT() or png_set_text_2() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application (CVE-2013-7353).

An integer overflow leading to a heap-based buffer overflow was found in the png_set_unknown_chunks() API function of libpng. An attacker could create a specially crafted image file and render it with an application written to explicitly call png_set_unknown_chunks() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application (CVE-2013-7354).

The remote host is affected by the vulnerability described in GLSA-201408-06 (libpng: Multiple vulnerabilities)

    The png_push_read_chunk function in pngpread.c in the progressive       decoder enters an infinite loop, when it encounters a zero-length IDAT       chunk. In addition certain integer overflows have been detected and       corrected.
    The 1.2 branch is not affected by these vulnerabilities.
  Impact :

    A remote attacker could entice a user to open a specially crafted PNG       file using an application linked against libpng, possibly resulting in       Denial of Service.
  Workaround :

    There is no known workaround at this time.

This libpng12 update fixes the following two security issues.

  - bnc#873123: Fixed integer overflow leading to a     heap-based buffer overflow in png_set_sPLT() and     png_set_text_2() (CVE-2013-7354).

  - bnc#873124: Fixed integer overflow leading to a     heap-based buffer overflow in png_set_unknown_chunks()     (CVE-2013-7353).

This libpng update fixes the following security issue :

  - bnc#873124: Fixed integer overflow leading to a     heap-based buffer overflow in png_set_unknown_chunks()     (CVE-2013-7353).

  - bnc#873123: integer overflow leading to a heap-based     buffer overflow in png_set_sPLT() and png_set_text_2()     (CVE-2013-7354)

- Update to 1.5.18

    - Fixes CVE-2013-7353 CVE-2013-7354 (RHBZ #1086671)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This libpng update fixes the following two overflow security issues.

  - Fixed integer overflow that could have lead to a     heap-based buffer overflow in png_set_sPLT() and     png_set_text_2(). (CVE-2013-7354). (bnc#873123)

  - Fixed integer overflow that could have lead to a     heap-based buffer overflow in png_set_unknown_chunks().
    (CVE-2013-7353). (bnc#873124)

Updated libpng packages fix security vulnerabilities :

An integer overflow leading to a heap-based buffer overflow was found in the png_set_sPLT() and png_set_text_2() API functions of libpng. An attacker could create a specially crafted image file and render it with an application written to explicitly call png_set_sPLT() or png_set_text_2() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application (CVE-2013-7353).

An integer overflow leading to a heap-based buffer overflow was found in the png_set_unknown_chunks() API function of libpng. An attacker could create a specially crafted image file and render it with an application written to explicitly call png_set_unknown_chunks() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application (CVE-2013-7354).

ID	Name	Product	Family	Severity
135658	EulerOS Virtualization 3.0.2.2 : libpng (EulerOS-SA-2020-1496)	Nessus	Huawei Local Security Checks	medium
134545	EulerOS Virtualization for ARM 64 3.0.2.0 : libpng (EulerOS-SA-2020-1256)	Nessus	Huawei Local Security Checks	medium
131875	EulerOS 2.0 SP2 : libpng (EulerOS-SA-2019-2383)	Nessus	Huawei Local Security Checks	medium
130709	EulerOS 2.0 SP3 : libpng (EulerOS-SA-2019-2247)	Nessus	Huawei Local Security Checks	medium
129132	EulerOS 2.0 SP5 : libpng (EulerOS-SA-2019-1975)	Nessus	Huawei Local Security Checks	medium
82324	Mandriva Linux Security Advisory : libpng12 (MDVSA-2015:071)	Nessus	Mandriva Local Security Checks	medium
77213	GLSA-201408-06 : libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
75349	openSUSE Security Update : libpng12 (openSUSE-SU-2014:0618-1)	Nessus	SuSE Local Security Checks	medium
75348	openSUSE Security Update : libpng15 (openSUSE-SU-2014:0616-1)	Nessus	SuSE Local Security Checks	medium
74404	Fedora 19 : mingw-libpng-1.5.18-1.fc19 (2014-6892)	Nessus	Fedora Local Security Checks	medium
74210	SuSE 11.3 Security Update : libpng (SAT Patch Number 9170)	Nessus	SuSE Local Security Checks	medium
73976	Mandriva Linux Security Advisory : libpng (MDVSA-2014:084)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2013-7354

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium