Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpng | Aug 30, 2017 | May 6, 2014 |
| Debian | — | Upgrade libpng1.6 | Jul 30, 2024 | May 6, 2014 |
| Gentoo Linux | — | Upgrade media-libs/libpng. | Oct 30, 2017 | May 6, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libpngUpgrade libpng-devel | Dec 4, 2019 | May 6, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libpngUpgrade libpng-devel | Nov 19, 2019 | May 6, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libpng-develUpgrade libpng | Sep 24, 2019 | May 6, 2014 |
| Suse | — | Upgrade libpng15-15-32bitUpgrade libpng12-develUpgrade libpng15-compat-devel-32bitUpgrade libpng12-compat-develUpgrade libpng12-0-32bitUpgrade libpng12Upgrade libpng15-compat-develUpgrade libpng15-develUpgrade libpng15-devel-32bitUpgrade libpng12-0-x86Upgrade libpng-develUpgrade libpng15Upgrade libpng12-compat-devel-32bitUpgrade libpng12-0Upgrade libpng15-15Upgrade sle-sdk-releaseUpgrade libpng-devel-32bitUpgrade libpng12-devel-32bit | May 29, 2014 | May 6, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub