Code injection

The ClamAV Engine version 0.103.1 and below component embedded in Storsmshield Network Security SNS is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1...

CVE-2021-27506

The ClamAV Engine version 0.103.1 and below component embedded in Storsmshield Network Security SNS is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1...

PT-2021-17484 · Netasq +2 · Netasq +2

Name of the Vulnerable Software and Affected Versions: Stormshield Network Security versions 1.0.0 through 4.2.0 Netasq versions 9.1.0 through 9.1.11 Description: The issue affects the ClamAV Engine component, which can be subject to a Denial of Service DoS when parsing malformed png files, leadi...

Security Researcher Hides ZIP, MP3 Files Inside PNG Files on Twitter

A security researcher has discovered a novel steganography technique for hiding data inside a Portable Network Graphics .PNG image file posted on Twitter, a tactic that could be exploited by threat actors to hide malicious activity. Researcher David Buchanan heralded his discovery on Twitter...

WordPress < 4.4 Weak PNG Vulnerability

WordPress is using a weak Pseudorandom Number Generator PNG for password reset tokens. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

EulerOS Virtualization for ARM 64 3.0.2.0 : python-pillow (EulerOS-SA-2021-1383)

According to the versions of the python-pillow package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG...

EulerOS Virtualization 3.0.2.6 : python-pillow (EulerOS-SA-2021-1421)

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state-shuffl...

Updated pngcheck packages fix security vulnerabilities

This update fixes a buffer-overrun bug related to the MNG LOOP chunk which gets noticed even in PNG files if the -s option is used. RHBZ1908559. It also fixes a buffer overrun for certain invalid MNG PPLT chunk contents. RHBZ1907428...

EulerOS Virtualization 3.0.6.6 : python-pillow (EulerOS-SA-2021-1515)

According to the versions of the python-pillow package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that ha...

EulerOS Virtualization for ARM 64 3.0.6.0 : openjpeg2 (EulerOS-SA-2021-1587)

According to the version of the openjpeg2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw...

Denial Of Service (DoS)

png-img is vulnerable to denial of service. The vulnerability exists as an attacker is able to pass a malicious PNG file to PngImg::InitStorage function of png-img to trigger an under-allocation of heap memory, resulting in an application crash...

CVE-2020-28248

An integer overflow in the PngImg::InitStorage function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file...

CVE-2020-28248

An integer overflow in the PngImg::InitStorage function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file...

Design/Logic Flaw

An integer overflow in the PngImg::InitStorage function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file...

CVE-2020-28248

An integer overflow in the PngImg::InitStorage function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file...

CVE-2020-28248

CVE-2020-28248 affects png-img up to version 3.0.x (before 3.1.0). The issue is an integer overflow in PngImg::InitStorage_() that under-allocates heap memory, leading to a heap-based buffer overflow while loading a crafted PNG. Impact is a memory corruption risk that can cause a crash or potenti...

png-img Input Validation Error Vulnerability

Rashid Ksirov png-img is an application from the Rashid Ksirov community in the USA. It provides a Lite self contained png image processing library for macOS and Linux. An input validation error vulnerability exists in png-img. The vulnerability stems from the package's PngImg::InitStorage functi...

[SECURITY] Fedora 32 Update: pngcheck-2.4.0-7.fc32

pngcheck verifies the integrity of PNG, JNG and MNG files by checking the internal 32-bit CRCs checksums and decompressing the image data; it can optionally dump almost all of the chunk-level information in the image in human-readable form. For example, it can be used to print the basic statist i...

[SECURITY] Fedora 33 Update: pngcheck-2.4.0-7.fc33

pngcheck verifies the integrity of PNG, JNG and MNG files by checking the internal 32-bit CRCs checksums and decompressing the image data; it can optionally dump almost all of the chunk-level information in the image in human-readable form. For example, it can be used to print the basic statist i...

Debian DLA-2550-1 : openjpeg2 security update

Various overflow errors were identified and fixed. CVE-2020-27814 A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. CVE-2020-27823 Wrong computation of x1,y1 if -d option is used, resulting in heap buffer overflow. CVE-2020-27824 Global buffer overflow on...