Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpng | Aug 30, 2017 | May 6, 2014 |
| Debian | — | Upgrade libpng1.6 | Jul 30, 2024 | May 6, 2014 |
| Gentoo Linux | — | Upgrade media-libs/libpng. | Oct 30, 2017 | May 6, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libpngUpgrade libpng-devel | Dec 4, 2019 | May 6, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libpng-develUpgrade libpng | Nov 19, 2019 | May 6, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libpngUpgrade libpng-devel | Sep 24, 2019 | May 6, 2014 |
| Suse | — | Upgrade libpng15-15Upgrade libpng12-0Upgrade libpng-devel-32bitUpgrade libpng12-compat-develUpgrade libpng15-compat-develUpgrade libpng12-compat-devel-32bitUpgrade libpng12-0-x86Upgrade libpng15Upgrade libpng-develUpgrade libpng12-devel-32bitUpgrade libpng15-devel-32bitUpgrade libpng15-compat-devel-32bitUpgrade libpng12-develUpgrade libpng15-develUpgrade libpng15-15-32bitUpgrade libpng12Upgrade libpng12-0-32bitUpgrade sle-sdk-release | May 29, 2014 | May 6, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub