Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.

An update of the syslinux package has been released.

According to the versions of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in the png_combine_row     function in libpng before 1.5.21 and 1.6.x before     1.6.16, when running on 64-bit systems, might allow     context-dependent attackers to execute arbitrary code     via a 'very wide interlaced' PNG image.(CVE-2014-9495)

  - Buffer overflow in the png_read_IDAT_data function in     pngrutil.c in libpng before 1.5.21 and 1.6.x before     1.6.16 allows context-dependent attackers to execute     arbitrary code via IDAT data with a large width, a     different vulnerability than     CVE-2014-9495.(CVE-2015-0973)

  - Buffer overflow in the png_set_PLTE function in libpng     before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x,     1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x     before 1.6.20 allows remote attackers to cause a denial     of service (application crash) or possibly have     unspecified other impact via a small bit-depth value in     an IHDR (aka image header) chunk in a PNG image. NOTE:
    this vulnerability exists because of an incomplete fix     for CVE-2015-8126.(CVE-2015-8472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.4 and is affected by multiple vulnerabilities in the following components :

 - apache_mod_php
 - AppleRAID
 - AppleUSBNetworking
 - Bluetooth
 - Carbon
 - dyld
 - FontParser
 - HTTPProtocol
 - Intel Graphics Driver
 - IOFireWireFamily
 - IOGraphics
 - IOHIDFamily
 - IOUSBFamily
 - Kernel
 - libxml2
 - Messages
 - NVIDIA Graphics Drivers
 - OpenSSH
 - OpenSSL
 - Python
 - QuickTime
 - Reminders
 - Ruby
 - Security
 - Tcl
 - TrueTypeScaler
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.9.5 or 10.10.5 and is missing Security Update 2016-002. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - Kernel
  - libxml2
  - OpenSSH
  - Python
  - Tcl

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.4. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppleRAID
  - AppleUSBNetworking
  - Bluetooth
  - Carbon
  - dyld
  - FontParser
  - HTTPProtocol
  - Intel Graphics Driver
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - IOUSBFamily
  - Kernel
  - libxml2
  - Messages
  - NVIDIA Graphics Drivers
  - OpenSSH
  - OpenSSL
  - Python
  - QuickTime
  - Reminders
  - Ruby
  - Security
  - Tcl
  - TrueTypeScaler
  - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This update fixes the following security issues :

  - CVE-2014-9495: libpng versions heap overflow     vulnerability, that under certain circumstances could be     exploit. [bnc#912076]

  - CVE-2015-0973: A heap-based overflow was found in the     png_combine_row() function of the libpng library, when     very large interlaced images were used.[bnc#912929]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libpng package fixes security vulnerabilities :

The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero (CVE-2014-0333).

libpng versions 1.6.9 through 1.6.15 have an integer-overflow vulnerability in png_combine_row() when decoding very wide interlaced images, which can allow an attacker to overwrite an arbitrary amount of memory with arbitrary (attacker-controlled) data (CVE-2014-9495).

This update addresses a couple of buffer overflows that might allow context-dependent attackers to execute arbitrary code via very wide PNG images.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201502-10 (libpng: User-assisted execution of arbitrary code)

    Two vulnerabilities have been discovered in libpng:
      The png_user_version_check function contains an out-of-bounds memory         access error (libpng 1.6.15 Release Notes)       The png_combine_row function contains an integer overflow error,         which could result in a heap-based buffer overflow (CVE-2014-9495)   Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PNG file using an application linked against libpng, possibly       resulting in execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

libpng was updated to fix some security issues :

  - CVE-2014-9495 [bnc#912076]: Heap-buffer overflow     png_combine_row() with very wide interlaced images

  - CVE-2015-0973 [bnc#912929]: overflow in     png_read_IDAT_data

libpng is now also build with -DPNG_SAFE_LIMITS_SUPPORTED.

ID	Name	Product	Family	Severity
204258	Photon OS 5.0: Syslinux PHSA-2023-5.0-0033	Nessus	PhotonOS Local Security Checks	critical
204103	Photon OS 3.0: Syslinux PHSA-2023-3.0-0602	Nessus	PhotonOS Local Security Checks	critical
203638	Photon OS 4.0: Syslinux PHSA-2023-4.0-0415	Nessus	PhotonOS Local Security Checks	critical
137503	EulerOS 2.0 SP2 : libpng (EulerOS-SA-2020-1661)	Nessus	Huawei Local Security Checks	high
9327	Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
90097	Mac OS X 10.9.5 / 10.10.5 Multiple Vulnerabilities (Security Update 2016-002)	Nessus	MacOS X Local Security Checks	critical
90096	Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
83669	SUSE SLED12 / SLES12 Security Update : libpng16 (SUSE-SU-2015:0092-1)	Nessus	SuSE Local Security Checks	critical
82343	Mandriva Linux Security Advisory : libpng (MDVSA-2015:090)	Nessus	Mandriva Local Security Checks	critical
81712	Fedora 21 : libpng10-1.0.63-1.fc21 (2015-2863)	Nessus	Fedora Local Security Checks	critical
81711	Fedora 20 : libpng10-1.0.63-1.fc20 (2015-2830)	Nessus	Fedora Local Security Checks	critical
81710	Fedora 22 : libpng10-1.0.63-1.fc22 (2015-2765)	Nessus	Fedora Local Security Checks	critical
81368	GLSA-201502-10 : libpng: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
81063	openSUSE Security Update : libpng16 (openSUSE-SU-2015:0161-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2014-9495

critical

Tenable Plugins

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical