Описание
Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.
An out of bounds read has been discovered in libwebsockets. The issue is caused by the lws_upng_emit_next_line function, specifically in the branch when uf->padded is true, in the loop where it reads from the sliding window, ibp is incremented but never reset,
making it possible to read past the buffer, and if the input file is big
enough, reading past the currently mapped heap memory causing a crash.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Interconnect 1 | libwebsockets | Fix deferred | ||
| Red Hat OpenStack Platform 16.2 | libwebsockets | Fix deferred | ||
| Red Hat OpenStack Platform 17.1 | libwebsockets | Fix deferred | ||
| Red Hat Service Interconnect 2 | libwebsockets | Fix deferred |
Показывать по
Дополнительная информация
Статус:
3.1 Low
CVSS3
Связанные уязвимости
Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.
Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.
Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets ...
Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.
3.1 Low
CVSS3