SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

It was discovered that libpng did not properly perform bounds checking in certain operations. An attacker could send a specially crafted PNG image and cause a denial of service in applications linked against libpng. This issue only affected Ubuntu 8.04 LTS. (CVE-2007-5268, CVE-2007-5269)

Tavis Ormandy discovered that libpng did not properly initialize memory. If a user or automated system were tricked into opening a crafted PNG image, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue did not affect Ubuntu 8.10. (CVE-2008-1382)

Harald van Dijk discovered an off-by-one error in libpng. An attacker could could cause an application crash in programs using pngtest.
(CVE-2008-3964)

It was discovered that libpng did not properly NULL terminate a keyword string. An attacker could exploit this to set arbitrary memory locations to zero. (CVE-2008-5907)

Glenn Randers-Pehrson discovered that libpng did not properly initialize pointers. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0040).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200812-15 (POV-Ray: User-assisted execution of arbitrary code)

    POV-Ray uses a statically linked copy of libpng to view and output PNG     files. The version shipped with POV-Ray is vulnerable to CVE-2008-3964,     CVE-2008-1382, CVE-2006-3334, CVE-2006-0481, CVE-2004-0768. A bug in     POV-Ray's build system caused it to load the old version when your     installed copy of libpng was >=media-libs/libpng-1.2.10.
  Impact :

    An attacker could entice a user to load a specially crafted PNG file as     a texture, resulting in the execution of arbitrary code with the     permissions of the user running the application.
  Workaround :

    There is no known workaround at this time.

A number of vulnerabilities have been found and corrected in libpng :

Fixed 1-byte buffer overflow in pngpread.c (CVE-2008-3964). This was allready fixed in Mandriva Linux 2009.0.

Fix the function png_check_keyword() that allowed setting arbitrary bytes in the process memory to 0 (CVE-2008-5907).

Fix a potential DoS (Denial of Service) or to potentially compromise an application using the library (CVE-2009-0040).

The updated packages have been patched to prevent this.

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

ID	Name	Product	Family	Published	Updated	Severity
107983	Solaris 10 (x86) : 137081-10	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	high
107483	Solaris 10 (sparc) : 137080-07	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	high
107485	Solaris 10 (sparc) : 137080-10	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	high
37042	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : libpng vulnerabilities (USN-730-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	high
35107	GLSA-200812-15 : POV-Ray: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	12/15/2008	1/6/2021	high
36671	Mandriva Linux Security Advisory : libpng (MDVSA-2009:051)	Nessus	Mandriva Local Security Checks	4/23/2009	1/6/2021	medium
107484	Solaris 10 (sparc) : 137080-09	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	high
107981	Solaris 10 (x86) : 137081-07	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	high
107982	Solaris 10 (x86) : 137081-09	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

medium

high

high

high