Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpng | Aug 30, 2017 | May 6, 2014 |
| Debian | — | Upgrade libpng1.6 | Jul 30, 2024 | May 6, 2014 |
| Gentoo Linux | — | Upgrade media-libs/libpng. | Oct 30, 2017 | May 6, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libpngUpgrade libpng-devel | Dec 4, 2019 | May 6, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libpngUpgrade libpng-devel | Nov 19, 2019 | May 6, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libpng-develUpgrade libpng | Sep 24, 2019 | May 6, 2014 |
| Suse | — | Upgrade libpng-devel-32bitUpgrade libpng12-compat-develUpgrade libpng12-0-x86Upgrade libpng15-15Upgrade libpng12-compat-devel-32bitUpgrade libpng-develUpgrade libpng15-compat-develUpgrade libpng12-0Upgrade libpng15-devel-32bitUpgrade libpng15Upgrade libpng12-devel-32bitUpgrade libpng15-compat-devel-32bitUpgrade libpng15-develUpgrade libpng12-0-32bitUpgrade libpng12Upgrade sle-sdk-releaseUpgrade libpng12-develUpgrade libpng15-15-32bit | May 29, 2014 | May 6, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub