CPANSA-Prima-codecs-win32-2015-8126-libpng: Prima-codecs-win32 vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2015-11-13T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2015-11-13T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score Severity
Original language Language en
Also referred to

Vulnerability Description

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Vulnerabilities

CVE-2015-8126

Vulnerability Description

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Weakness CWE-120 : Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Product status

Known affected
Product Score
Prima-codecs-win32 greater than or equal 1.00 and less than or equal 1.01
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
2.0 AV:N/AC:L/Au:N/C:P/I:P/A:P 7.5 High

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Fri Nov 13 00:00:00 2015 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/