CVE-2007-5269: Input Validation

Q: What is the severity of CVE-2007-5269?

CVE-2007-5269 has been classified as a denial of service vulnerability.

Q: How do I fix CVE-2007-5269?

To fix CVE-2007-5269, ensure that you upgrade libpng to version 1.0.29 or 1.2.21 or later.

Q: What software versions are affected by CVE-2007-5269?

CVE-2007-5269 affects libpng versions prior to 1.0.29 and 1.2.x before 1.2.21.

Q: What types of attacks are possible with CVE-2007-5269?

CVE-2007-5269 allows remote attackers to cause a crash by sending specially crafted chunk data.

Q: Are there any known exploits for CVE-2007-5269?

There are no specific exploits publicly disclosed for CVE-2007-5269, but its nature poses a risk of service disruption.

Published Oct 8, 2007

Updated

Certain chunk handlers in libpng before 1.0.29 and 1.2.x before 1.2.21 allow remote attackers to cause a denial of service (crash) via crafted (1) pCAL (pnghandlepCAL), (2) sCAL (pnghandlesCAL), (3) tEXt (pngpushreadtEXt), (4) iTXt (pnghandleiTXt), and (5) ztXT (pnghandleztXt) chunking in PNG images, which trigger out-of-bounds read operations.

Affected Software

2 affected components

libpng LIBPNG<=1.2.20

libpng LIBPNG=1.0.28

Remediation

Patch Available

http://sourceforge.net/mailarchive/forum.php?thread_name=3.0.6.32.20071004082318.012a7628%40mail.comcast.net&forum_name=png-mng-implement

Event History

Oct 8, 2007

CVE Published

09:17 PM

Oct 9, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5269?

CVE-2007-5269 has been classified as a denial of service vulnerability.

How do I fix CVE-2007-5269?