CVE-2004-0421: Medium severity libpng LIBPNG vulnerability
From: Steve G <linux4ever>
In the pngformatbuffer function located in pngerror.c around line 133 is the following code:
if (message == NULL) buffer[iout] = 0; else { buffer[iout++] = ':'; buffer[iout++] = ' '; pngmemcpy(buffer+iout, message, 64); buffer[iout+63] = 0; } This code is called from the pngchunkerror & pngchunkwarning functions. An example of their use would be in pngutil.c around line 119. pngchunkerror(pngptr, "CRC error"); In the above code, the message being constructed is only 10 characters long. The pngmemcpy function will unconditionally access 54 bytes beyond the message.
This could cause a carefully crafted png image to cause a denial of service.
Possibly embargoed; marking as embargoed until communicated otherwise.
Other sources
The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-0421?
CVE-2004-0421 is classified as a high severity vulnerability due to potential information disclosure.
How do I fix CVE-2004-0421?
To remediate CVE-2004-0421, upgrade to a patched version of libpng or apply the recommended security fixes provided by your distribution.
What versions of libpng are affected by CVE-2004-0421?
CVE-2004-0421 affects libpng versions 1.0.0 through 1.2.5.
Can CVE-2004-0421 lead to code execution?
CVE-2004-0421 primarily poses a risk of information disclosure rather than direct code execution.
Is there a known exploit for CVE-2004-0421?
There are reports of exploit code being developed for CVE-2004-0421, thus it is advisable to take mitigation measures promptly.