CVE-2022-3857

2023-03-0600:00:00

ubuntu.com

libpng 1.6.38

segmentation fault

denial of service

png_setup_paeth_row function

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

JSON

A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a
segmentation fault and denial of service in png_setup_paeth_row() function.

Bugs

Notes

Author	Note
iconstantin	no upstream fix available as of 2024-07-02

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchlibpng< anyUNKNOWN
ubuntu16.04noarchlibpng< anyUNKNOWN
ubuntu18.04noarchlibpng1.6< anyUNKNOWN
ubuntu20.04noarchlibpng1.6< anyUNKNOWN
ubuntu22.04noarchlibpng1.6< anyUNKNOWN
ubuntu23.10noarchlibpng1.6< anyUNKNOWN
ubuntu24.04noarchlibpng1.6< anyUNKNOWN
ubuntu16.04noarchlibpng1.6< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	libpng	< any	UNKNOWN
ubuntu	16.04	noarch	libpng	< any	UNKNOWN
ubuntu	18.04	noarch	libpng1.6	< any	UNKNOWN
ubuntu	20.04	noarch	libpng1.6	< any	UNKNOWN
ubuntu	22.04	noarch	libpng1.6	< any	UNKNOWN
ubuntu	23.10	noarch	libpng1.6	< any	UNKNOWN
ubuntu	24.04	noarch	libpng1.6	< any	UNKNOWN
ubuntu	16.04	noarch	libpng1.6	< any	UNKNOWN