REDHAT-BUG-1281756: Buffer Overflow
First published: Fri Nov 13 2015(Updated: )
Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8. Affected versions of libpng are before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19. Upstream patches: <a href="https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b7a766">https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b7a766</a> <a href="https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208cb54d">https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208cb54d</a> <a href="https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57d5978">https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57d5978</a> <a href="https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466">https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466</a> <a href="https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324">https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324</a> CVE assignment: <a href="http://seclists.org/oss-sec/2015/q4/264">http://seclists.org/oss-sec/2015/q4/264</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| libp2p | <1.0.64>1.1.0<1.1.x<1.2.54>1.3.0<1.3.x>1.4.0<1.4.x<1.5.24>1.6.0<1.6.x<1.6.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b7a766
- https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208cb54d
- https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57d5978
- https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466
- https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324
- http://seclists.org/oss-sec/2015/q4/264
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281757
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281759
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281758
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281760
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281756#c2
- https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324.patch
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1281756#c0
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1282901
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1282902
- https://access.redhat.com/security/cve/CVE-2015-8472
- http://seclists.org/oss-sec/2015/q4/439
- https://rhn.redhat.com/errata/RHSA-2015-2594.html
- https://rhn.redhat.com/errata/RHSA-2015-2596.html
- https://rhn.redhat.com/errata/RHSA-2015-2595.html
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/817a472b15bd
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/23a6e0931277
- https://access.redhat.com/security/cve/CVE-2015-8126
- https://rhn.redhat.com/errata/RHSA-2016-0057.html
- https://rhn.redhat.com/errata/RHSA-2016-0056.html
- https://rhn.redhat.com/errata/RHSA-2016-0055.html
- https://rhn.redhat.com/errata/RHSA-2016-0101.html
- https://rhn.redhat.com/errata/RHSA-2016-0100.html
- https://rhn.redhat.com/errata/RHSA-2016-0098.html
- https://rhn.redhat.com/errata/RHSA-2016-0099.html
- https://access.redhat.com/errata/RHSA-2016:1430
- https://bugzilla.redhat.com/show_bug.cgi?id=1281756
Frequently Asked Questions
What is the severity of REDHAT-BUG-1281756?
The severity of REDHAT-BUG-1281756 is critical due to potential remote DoS attacks and unspecified impacts.
How do I fix REDHAT-BUG-1281756?
To fix REDHAT-BUG-1281756, update your libpng to the latest version that addresses this buffer overflow vulnerability.
Which versions of libpng are affected by REDHAT-BUG-1281756?
The affected versions of libpng include all versions up to 1.0.64, from 1.1.0 to 1.1.x, up to 1.2.54, from 1.3.0 to 1.3.x, from 1.4.0 to 1.4.x, up to 1.5.24, from 1.6.0 to 1.6.x, and up to 1.6.19.
What causes the vulnerability in REDHAT-BUG-1281756?
The vulnerability in REDHAT-BUG-1281756 is caused by buffer overflow in png_get_PLTE and png_set_PLTE functions due to inadequate checks for out-of-range palette values when processing PNG files.
Can REDHAT-BUG-1281756 lead to data loss?
While REDHAT-BUG-1281756 primarily poses a risk of denial of service, the underlying buffer overflow could potentially lead to data corruption or loss, depending on how the vulnerability is exploited.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-8126
- agent/source
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/libpng
- canonical/go-libp2p