CVE-2012-3425: Buffer Overflow
Published Aug 13, 2012
·Updated
The pngpushreadzTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large availin field value in a PNG image.
Affected Software
149 affected components
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=15.04
Canonical Ubuntu Linux=15.10
libpng LIBPNG=1.4.0
libpng LIBPNG=1.4.1
libpng LIBPNG=1.4.2
libpng LIBPNG=1.4.3
libpng LIBPNG=1.4.4
libpng LIBPNG=1.4.5
libpng LIBPNG=1.4.6
libpng LIBPNG=1.4.7
libpng LIBPNG=1.4.8
libpng LIBPNG=1.4.9
openSUSE openSUSE=11.4
openSUSE openSUSE=12.1
libpng LIBPNG=1.2.0
libpng LIBPNG=1.2.1
libpng LIBPNG=1.2.2
libpng LIBPNG=1.2.3
libpng LIBPNG=1.2.4
libpng LIBPNG=1.2.5
libpng LIBPNG=1.2.6
libpng LIBPNG=1.2.7
libpng LIBPNG=1.2.8
libpng LIBPNG=1.2.9
libpng LIBPNG=1.2.10
libpng LIBPNG=1.2.11
libpng LIBPNG=1.2.12
libpng LIBPNG=1.2.13
libpng LIBPNG=1.2.14
libpng LIBPNG=1.2.15
libpng LIBPNG=1.2.16
libpng LIBPNG=1.2.17
libpng LIBPNG=1.2.18
libpng LIBPNG=1.2.19
libpng LIBPNG=1.2.20
libpng LIBPNG=1.2.21
libpng LIBPNG=1.2.22
libpng LIBPNG=1.2.23
libpng LIBPNG=1.2.24
libpng LIBPNG=1.2.25
libpng LIBPNG=1.2.26
libpng LIBPNG=1.2.27
libpng LIBPNG=1.2.28
libpng LIBPNG=1.2.29
libpng LIBPNG=1.2.30
libpng LIBPNG=1.2.31
libpng LIBPNG=1.2.32
libpng LIBPNG=1.2.33
libpng LIBPNG=1.2.34
libpng LIBPNG=1.2.35
libpng LIBPNG=1.2.36
libpng LIBPNG=1.2.37
libpng LIBPNG=1.2.38
libpng LIBPNG=1.2.39
libpng LIBPNG=1.2.40
libpng LIBPNG=1.2.41
libpng LIBPNG=1.2.42
libpng LIBPNG=1.2.43
libpng LIBPNG=1.2.43-devel
libpng LIBPNG=1.2.44
libpng LIBPNG=1.2.45
libpng LIBPNG=1.2.45-devel
libpng LIBPNG=1.2.46
libpng LIBPNG=1.2.46-devel
libpng LIBPNG=1.2.47
libpng LIBPNG=1.2.47-beta
libpng LIBPNG=1.2.48-betas
redhat Libpng=1.2.2-16
redhat Libpng=1.2.2-20
Debian Debian Linux=6.0
libpng LIBPNG=1.5.0-beta
libpng LIBPNG=1.5.1
libpng LIBPNG=1.5.1-beta
libpng LIBPNG=1.5.2
libpng LIBPNG=1.5.2-beta
libpng LIBPNG=1.5.3-beta
libpng LIBPNG=1.5.4
libpng LIBPNG=1.5.4-beta
libpng LIBPNG=1.5.5
libpng LIBPNG=1.5.5-beta
libpng LIBPNG=1.5.6
libpng LIBPNG=1.5.6-beta
libpng LIBPNG=1.5.7
libpng LIBPNG=1.5.7-beta
libpng LIBPNG=1.5.8
libpng LIBPNG=1.5.8-beta
libpng LIBPNG=1.5.9
libpng LIBPNG=1.5.9-beta
libpng LIBPNG=1.5.10-beta
libpng LIBPNG=1.0.0
libpng LIBPNG=1.0.1
libpng LIBPNG=1.0.2
libpng LIBPNG=1.0.3
libpng LIBPNG=1.0.5
libpng LIBPNG=1.0.6
libpng LIBPNG=1.0.7
libpng LIBPNG=1.0.8
libpng LIBPNG=1.0.9
libpng LIBPNG=1.0.10
libpng LIBPNG=1.0.11
libpng LIBPNG=1.0.12
libpng LIBPNG=1.0.13
libpng LIBPNG=1.0.14
libpng LIBPNG=1.0.15
libpng LIBPNG=1.0.16
libpng LIBPNG=1.0.17
libpng LIBPNG=1.0.18
libpng LIBPNG=1.0.19
libpng LIBPNG=1.0.20
libpng LIBPNG=1.0.21
libpng LIBPNG=1.0.22
libpng LIBPNG=1.0.23
libpng LIBPNG=1.0.24
libpng LIBPNG=1.0.25
libpng LIBPNG=1.0.26
libpng LIBPNG=1.0.27
libpng LIBPNG=1.0.28
libpng LIBPNG=1.0.29
libpng LIBPNG=1.0.30
libpng LIBPNG=1.0.31
libpng LIBPNG=1.0.32
libpng LIBPNG=1.0.33
libpng LIBPNG=1.0.34
libpng LIBPNG=1.0.35
libpng LIBPNG=1.0.37
libpng LIBPNG=1.0.38
libpng LIBPNG=1.0.39
libpng LIBPNG=1.0.40
libpng LIBPNG=1.0.41
libpng LIBPNG=1.0.42
libpng LIBPNG=1.0.43
libpng LIBPNG=1.0.44
libpng LIBPNG=1.0.45
libpng LIBPNG=1.0.46
libpng LIBPNG=1.0.47
libpng LIBPNG=1.0.48
libpng LIBPNG=1.0.50
libpng LIBPNG=1.0.51
libpng LIBPNG=1.0.52
libpng LIBPNG=1.0.53
libpng LIBPNG=1.0.54
libpng LIBPNG=1.0.55
libpng LIBPNG=1.0.55-rc01
libpng LIBPNG=1.0.56
libpng LIBPNG=1.0.56-devel
libpng LIBPNG=1.0.57
libpng LIBPNG=1.0.57-rc01
Event History
Aug 13, 2012
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-3425?
CVE-2012-3425 has a severity rating that allows remote attackers to cause a denial of service through an out-of-bounds read.
2
How do I fix CVE-2012-3425?
To fix CVE-2012-3425, update libpng to version 1.0.58, 1.2.48, 1.4.10, or 1.5.10 or later.
3
Which versions of libpng are affected by CVE-2012-3425?
CVE-2012-3425 affects libpng versions 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10.
4
What type of vulnerability is CVE-2012-3425?
CVE-2012-3425 is a vulnerability that allows for denial of service through an out-of-bounds read.
5
Are multiple operating systems affected by CVE-2012-3425?
Yes, CVE-2012-3425 affects multiple operating systems including Ubuntu and openSUSE that use the vulnerable versions of libpng.