GLSA-200804-15 : libpng: Execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200804-15 libpng: Execution of arbitrary code Tavis Ormandy of the Google Security Team discovered that libpng does not handle zero-length unknown chunks in PNG files correctly, which might lead to memory corruption in application...

Libpng库未知类型块处理远程代码执行漏洞

BUGTRAQ ID: 28770 CVECAN ID: CVE-2008-1382 libpng是多种应用程序所使用的解析PNG图形格式的函数库。 libpng库在处理畸形格式的PNG文件时存在漏洞，成功利用此漏洞允许本地攻击者读取敏感信息、导致拒绝服务或执行任意指令。 libpng库没有正确地处理未知类型的PNG块，如果使用该库的应用程序在特定情况下调用了pngsetreaduserchunkfn或pngsetkeepunknownchunks函数的话，长度为0的PNG块就会导致通过free调用使用未初始化的内存。 0 libpng libpng 1.2.0 - 1.2.26...

libpng: Execution of arbitrary code

Background libpng is a free ANSI C library used to process and manipulate PNG images. Description Tavis Ormandy of the Google Security Team discovered that libpng does not handle zero-length unknown chunks in PNG files correctly, which might lead to memory corruption in applications that call...

Design/Logic Flaw

libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory...

CVE-2008-1382

libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory...

CVE-2008-1382

libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory...

CVE-2008-1382

libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service crash and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory...

CVE-2008-1382

CVE-2008-1382 affects the libpng library. The issue is triggered by PNG files containing zero-length unknown chunks, causing an access to uninitialized memory and potentially enabling denial of service or arbitrary code execution. Affected library versions (per the primary CVE description): libpn...

[oCERT-2008-003] libpng zero-length chunks incorrect handling

2008/04/12 2008-003 libpng zero-length chunks incorrect handling Description: Applications using libpng that install unknown chunk handlers, or copy unknown chunks, may be vulnerable to a security issue which may result in incorrect output, information leaks, crashes, or arbitrary code execution...

libpng uninitialized memory reference

Uninitilized memory reference on zero-sized chunk with external chunk handlers...

png -- unknown chunk processing uninitialized memory access

Secunia reports: Tavis Ormandy has reported a vulnerability in libpng, which can be exploited by malicious people to cause a Denial of Service, disclose potentially sensitive information, or potentially compromise an application using the library. The vulnerability is caused due to the improper...

Solaris 10 (x86) : 137081-11 (deprecated)

SunOS 5.10x86: libpng Patch. Date this patch was last updated by Sun : Sep/11/17 This plugin has been deprecated and either replaced with individual 137081 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on...

Solaris 10 (sparc) : 137080-11 (deprecated)

SunOS 5.10: libpng Patch. Date this patch was last updated by Sun : Sep/11/17 This plugin has been deprecated and either replaced with individual 137080 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12...

Debian Security Advisory DSA 213-1 (libpng, libpng3)

The remote host is missing an update to libpng, libpng3 announced via advisory DSA 213-1. OpenVAS Vulnerability Test $Id: deb2131.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 213-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 536-1 (libpng)

The remote host is missing an update to libpng announced via advisory DSA 536-1. OpenVAS Vulnerability Test $Id: deb5361.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 536-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-570-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 498-1 (libpng, libpng3)

The remote host is missing an update to libpng, libpng3 announced via advisory DSA 498-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Debian Security Advisory DSA 498-1 (libpng, libpng3)

The remote host is missing an update to libpng, libpng3 announced via advisory DSA 498-1. OpenVAS Vulnerability Test $Id: deb4981.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 498-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 570-1 (libpng)

The remote host is missing an update to libpng announced via advisory DSA 570-1. OpenVAS Vulnerability Test $Id: deb5701.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 570-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 213-1 (libpng, libpng3)

The remote host is missing an update to libpng, libpng3 announced via advisory DSA 213-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...