CVE-2013-7354: Buffer Overflow
Published May 6, 2014
·Updated
Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) pngsetsPLT or (2) pngsettext2 function, which triggers a heap-based buffer overflow.
Affected Software
24 affected components
libpng LIBPNG<=1.5.13
libpng LIBPNG=1.5.0-beta
libpng LIBPNG=1.5.1
libpng LIBPNG=1.5.1-beta
libpng LIBPNG=1.5.2
libpng LIBPNG=1.5.2-beta
libpng LIBPNG=1.5.3-beta
libpng LIBPNG=1.5.4
libpng LIBPNG=1.5.4-beta
libpng LIBPNG=1.5.5
libpng LIBPNG=1.5.5-beta
libpng LIBPNG=1.5.6
libpng LIBPNG=1.5.6-beta
libpng LIBPNG=1.5.7
libpng LIBPNG=1.5.7-beta
libpng LIBPNG=1.5.8
libpng LIBPNG=1.5.8-beta
libpng LIBPNG=1.5.9
libpng LIBPNG=1.5.9-beta
libpng LIBPNG=1.5.10-beta
libpng LIBPNG=1.5.11
libpng LIBPNG=1.5.11-beta
libpng LIBPNG=1.5.12
libpng LIBPNG=1.5.13-beta
Event History
May 6, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-7354?
CVE-2013-7354 is considered a moderate severity vulnerability that can lead to denial of service through crashes.
2
How do I fix CVE-2013-7354?
To fix CVE-2013-7354, upgrade to libpng version 1.5.14rc04 or later.
3
Which versions of libpng are affected by CVE-2013-7354?
CVE-2013-7354 affects all versions of libpng prior to 1.5.14rc04.
4
How does CVE-2013-7354 exploit integer overflows?
CVE-2013-7354 exploits integer overflows in the png_set_sPLT and png_set_text_2 functions to create a heap-based buffer overflow.
5
Can CVE-2013-7354 allow remote attacks?
Yes, CVE-2013-7354 can allow remote attackers to exploit vulnerabilities by sending a crafted image.