CVE-2013-6954: Null Pointer Dereference
libpng 1.6.8 was released [1] and notes the following fix:
Handle zero-length PLTE chunk or NULL palette with pngerror() instead of pngchunkreport(), which by default issues a warning rather than an error, leading to later reading from a NULL pointer (pngptr->palette) in pngdoexpandpalette(). This is CVE-2013-6954 and VU#650142.
The git commit to fix is available [3].
[1] http://sourceforge.net/projects/libpng/files/libpng16/1.6.8/Gnupg/ [2] http://www.kb.cert.org/vuls/id/650142 [3] http://sourceforge.net/p/libpng/code/ci/1faa6ff32c648acfe3cf30a58d31d7aebc24968c
Other sources
The pngdoexpandpalette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE chunk of zero bytes or (2) a NULL palette, related to pngrtran.c and pngset.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.0-oracle-1:1.7.0.55-1jpp.2.el5_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.6.0-sun-1:1.6.0.75-1jpp.3.el5_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.0-oracle-1:1.7.0.55-1jpp.1.el6_5 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.6.0-sun-1:1.6.0.75-1jpp.1.el6_5 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el5_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el5_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.0-ibm-1:1.7.0.7.0-1jpp.1.el6_5 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.6.0-ibm-1:1.6.0.16.0-1jpp.1.el6_5 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.1-ibm-1:1.7.1.1.0-1jpp.2.el7_0 - Upgrade
Upgrade
redhat/libpngto a version that resolves this vulnerability.Fixed in 1.6.8 - Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.8 - Compensating control
For versions affected by CVE-2013-6954 (e.g., libpng < 1.6.8), mitigate by rejecting/denying PNG files that contain a PLTE chunk of zero bytes or a NULL palette before they reach libpng’s png_do_expand_palette() code path.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2013-6954?
CVE-2013-6954 is classified as a medium severity vulnerability.
What versions are affected by CVE-2013-6954?
CVE-2013-6954 affects libpng versions up to 1.6.8.
How do I fix CVE-2013-6954?
To fix CVE-2013-6954, upgrade to libpng version 1.6.9 or later.
What is the impact of CVE-2013-6954?
The impact of CVE-2013-6954 is the potential for an application to crash due to reading from a NULL pointer.
Does CVE-2013-6954 affect Java packages?
Yes, CVE-2013-6954 affects certain Java packages including both Oracle and IBM Java distributions.