CVE-2021-4214: Medium severity libpng LIBPNG vulnerability
A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.
Other sources
A vulnerability was reported in Libpng where the input buffer might not have the same length as the pre-defined value hardcoded in the pngimage so that the index is out of bound in the later loop.
References: https://github.com/glennrp/libpng/issues/302
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-4214?
CVE-2021-4214 is a heap overflow vulnerability found in libpng's pngimage.c program.
What is the severity of CVE-2021-4214?
The severity of CVE-2021-4214 is medium.
How does CVE-2021-4214 affect the affected software?
CVE-2021-4214 affects libpng version 1.6.0 and Debian Linux versions 10.0 and 11.0, as well as the NetApp ONTAP Select Deploy administration utility.
How can an attacker exploit CVE-2021-4214?
An attacker with local network access can exploit CVE-2021-4214 by passing a specially crafted PNG file to the pngimage utility, causing an application to crash and leading to a denial of service.
How can I fix the CVE-2021-4214 vulnerability?
To fix the CVE-2021-4214 vulnerability, update libpng to versions 1.6.36-6, 1.6.37-3, 1.6.39-2, or 1.6.40-2, or follow the recommended updates for the affected software.