[SECURITY] [DLA 343-1] libpng security update

2015-11-1721:30:41

lists.debian.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

86.8%

JSON

Package : libpng
Version : 1.2.44-1+squeeze5
CVE ID : CVE-2012-3425 CVE-2015-7981 CVE-2015-8126

CVE-2015-7981
Added a safety check in png_set_tIME() (Bug report from Qixue Xiao).
CVE-2015-8126
Multiple buffer overflows in the (1) png_set_PLTE and
(2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x
before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24,
and 1.6.x before 1.6.19 allow remote attackers to cause a denial
of service (application crash) or possibly have unspecified other
impact via a small bit-depth value in an IHDR (aka image header)
chunk in a PNG image.
CVE-2012-3425
vulnerable code is not present here

OSVersionArchitecturePackageVersionFilename
Debian6alllibpng3< 1.2.44-1+squeeze5libpng3_1.2.44-1+squeeze5_all.deb
Debian6alllibpng< 1.2.44-1+squeeze5libpng_1.2.44-1+squeeze5_all.deb
Debian6alllibpng12-dev< 1.2.44-1+squeeze5libpng12-dev_1.2.44-1+squeeze5_all.deb
Debian6alllibpng12-0-udeb< 1.2.44-1+squeeze5libpng12-0-udeb_1.2.44-1+squeeze5_all.deb
Debian6alllibpng12-0< 1.2.44-1+squeeze5libpng12-0_1.2.44-1+squeeze5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	all	libpng3	< 1.2.44-1+squeeze5	libpng3_1.2.44-1+squeeze5_all.deb
Debian	6	all	libpng	< 1.2.44-1+squeeze5	libpng_1.2.44-1+squeeze5_all.deb
Debian	6	all	libpng12-dev	< 1.2.44-1+squeeze5	libpng12-dev_1.2.44-1+squeeze5_all.deb
Debian	6	all	libpng12-0-udeb	< 1.2.44-1+squeeze5	libpng12-0-udeb_1.2.44-1+squeeze5_all.deb
Debian	6	all	libpng12-0	< 1.2.44-1+squeeze5	libpng12-0_1.2.44-1+squeeze5_all.deb