The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE chunk of zero bytes or (2) a NULL palette, related to pngrtran.c and pngset.c.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpng | Aug 30, 2017 | Jan 12, 2014 |
| Gentoo Linux | — | Upgrade dev-java/icedtea-bin. | Oct 30, 2017 | Jan 12, 2014 |
| Hpux | — | Update Jre60.JRE60-IPF32-HS to the latest versionUpdate Jdk60.JDK60-PWV2 to the latest versionUpdate Jre70.JRE70-IPF32-HS to the latest versionUpdate Jre60.JRE60-PA20-HS to the latest versionUpdate Jre60.JRE60-COM-DOC to the latest versionUpdate Jre60.JRE60-PA20 to the latest versionUpdate Jdk60.JDK60 to the latest versionUpdate Jdk60.JDK60-PNV2 to the latest versionUpdate Jdk60.JDK60-IPF64 to the latest versionUpdate Jre60.JRE60-PNV2 to the latest versionUpdate Jdk70.JDK70-IPF32 to the latest versionUpdate Jre60.JRE60-PWV2 to the latest versionUpdate Jdk70.JDK70-COM to the latest versionUpdate Jre60.JRE60-COM to the latest versionUpdate Jdk60.JDK60-PA20 to the latest versionUpdate Jdk60.JDK60-IPF32 to the latest versionUpdate Jre60.JRE60-PA20W-HS to the latest versionUpdate Jre60.JRE60-IPF64 to the latest versionUpdate Jre70.JRE70-IPF64 to the latest versionUpdate Jdk70.JDK70-IPF64 to the latest versionUpdate Jdk60.JDK60-PA20W to the latest versionUpdate Jre70.JRE70-COM to the latest versionUpdate Jre60.JRE60-IPF64-HS to the latest versionUpdate Jre60.JRE60-IPF32 to the latest versionUpdate Jdk60.JDK60-COM to the latest versionUpdate Jre60.JRE60-PA20W to the latest versionUpdate Jre60.JRE60-PWV2-H to the latest versionUpdate Jre70.JRE70-IPF32 to the latest versionUpdate Jre60.JRE60-PNV2-H to the latest versionUpdate Jdk70.JDK70-DEMO to the latest versionUpdate Jre70.JRE70-IPF64-HS to the latest version | Aug 11, 2017 | Jan 12, 2014 |
| Ibm Aix | — | Apply the fix or workaround for java_apr2014_advisory | Nov 30, 2017 | Jan 12, 2014 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Apr 17, 2014 | Jan 12, 2014 |
| Suse | — | Upgrade java-1_7_0-ibm-jdbcUpgrade libpng16-16Upgrade java-1_7_0-openjdk-develUpgrade java-1_6_0-ibm-32bitUpgrade java-1_7_0-openjdk-accessibilityUpgrade sle-sdk-releaseUpgrade libpng16Upgrade libpng16-toolsUpgrade java-1_7_0-ibmUpgrade java-1_7_0-openjdk-headlessUpgrade java-1_6_0-ibmUpgrade libpng16-compat-develUpgrade java-1_6_0-ibm-develUpgrade java-1_6_0-ibm-plugin-32bitUpgrade libpng16-compat-devel-32bitUpgrade java-1_6_0-ibm-fontsUpgrade java-1_7_0-openjdk-demoUpgrade java-1_6_0-ibm-alsa-32bitUpgrade java-1_7_0-openjdk-javadocUpgrade java-1_7_0-ibm-alsaUpgrade libpng16-develUpgrade java-1_7_0-ibm-pluginUpgrade java-1_6_0-ibm-pluginUpgrade java-1_6_0-ibm-alsaUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_6_0-ibm-devel-32bitUpgrade libpng16-devel-32bitUpgrade libpng16-16-32bitUpgrade java-1_7_0-openjdk-srcUpgrade java-1_7_0-ibm-develUpgrade java-1_7_0-openjdk | Jan 23, 2014 | Jan 12, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub