Описание
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | libpng | Will not fix | ||
| Oracle Java for Red Hat Enterprise Linux 5 | java-1.7.0-oracle | Fixed | RHSA-2016:0056 | 21.01.2016 |
| Oracle Java for Red Hat Enterprise Linux 5 | java-1.6.0-sun | Fixed | RHSA-2016:0057 | 21.01.2016 |
| Oracle Java for Red Hat Enterprise Linux 6 | java-1.8.0-oracle | Fixed | RHSA-2016:0055 | 21.01.2016 |
| Oracle Java for Red Hat Enterprise Linux 6 | java-1.7.0-oracle | Fixed | RHSA-2016:0056 | 21.01.2016 |
| Oracle Java for Red Hat Enterprise Linux 6 | java-1.6.0-sun | Fixed | RHSA-2016:0057 | 21.01.2016 |
| Oracle Java for Red Hat Enterprise Linux 7 | java-1.8.0-oracle | Fixed | RHSA-2016:0055 | 21.01.2016 |
| Oracle Java for Red Hat Enterprise Linux 7 | java-1.7.0-oracle | Fixed | RHSA-2016:0056 | 21.01.2016 |
| Oracle Java for Red Hat Enterprise Linux 7 | java-1.6.0-sun | Fixed | RHSA-2016:0057 | 21.01.2016 |
| Red Hat Enterprise Linux 5 Supplementary | java-1.7.0-ibm | Fixed | RHSA-2016:0100 | 02.02.2016 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.1 Medium
CVSS2
Связанные уязвимости
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, ...
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
EPSS
5.1 Medium
CVSS2