CVE-2015-8126: Buffer Overflow
Buffer overflow vulnerabilities in functions pnggetPLTE/pngsetPLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bitdepth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8.
Affected versions of libpng are before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19.
Upstream patches:
https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b7a766 https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208cb54d https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57d5978 https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466 https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324
CVE assignment:
http://seclists.org/oss-sec/2015/q4/264
Other sources
It was discovered that the pnggetPLTE() and pngsetPLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library.
Multiple buffer overflows in the (1) pngsetPLTE and (2) pnggetPLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2015-8126?
CVE-2015-8126 has a moderate severity level due to its potential to cause denial of service and unspecified impacts.
How do I fix CVE-2015-8126?
To fix CVE-2015-8126, update affected software packages to the remedied versions specified in the vulnerability advisory.
What software is affected by CVE-2015-8126?
CVE-2015-8126 affects various versions of the Java SDK and libpng across multiple operating systems.
Can CVE-2015-8126 lead to remote attacks?
Yes, CVE-2015-8126 allows remote attackers to exploit buffer overflow vulnerabilities, potentially leading to crashes.
What is a buffer overflow in the context of CVE-2015-8126?
In the context of CVE-2015-8126, a buffer overflow occurs when the png_get_PLTE and png_set_PLTE functions do not check for out-of-range palette data, which can lead to application instability.