Lucene search

K
archlinuxArch LinuxASA-201511-10
HistoryNov 17, 2015 - 12:00 a.m.

lib32-libpng: multiple issues

2015-11-1700:00:00
Arch Linux
lists.archlinux.org
23

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.012 Low

EPSS

Percentile

83.6%

  • CVE-2015-7981 (out-of-bounds read)

This is an array indexing error, which can lead to an out-of-bounds read
of a static buffer. The result is now unsigned (no longer negative, but
now a huge positive number).

  • CVE-2015-8126 (arbitrary code execution)

Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE,
allowing remote attackers to cause DoS to application or have
unspecified other impact. These functions failed to check for an
out-of-range palette when reading or writing PNG files with a bit_depth
less than 8. Some applications might read the bit depth from the IHDR
chunk and allocate memory for a 2^N entry palette, while libpng can
return a palette with up to 256 entries even when the bit depth is less
than 8.

OSVersionArchitecturePackageVersionFilename
anyanyanylib32-libpng< 1.6.19-1UNKNOWN

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.012 Low

EPSS

Percentile

83.6%