REDHAT-BUG-2416907: Buffer Overflow
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function pngimagefinishread when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.51
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2416907?
The severity of REDHAT-BUG-2416907 is considered high due to the potential for a heap buffer overflow.
How do I fix REDHAT-BUG-2416907?
To fix REDHAT-BUG-2416907, upgrade the libpng library to version 1.6.51 or later.
Which versions of LibPNG are affected by REDHAT-BUG-2416907?
LibPNG versions from 1.6.0 to before 1.6.51 are affected by REDHAT-BUG-2416907.
What type of vulnerability is REDHAT-BUG-2416907?
REDHAT-BUG-2416907 is a heap buffer overflow vulnerability occurring in the simplified API function of libpng.
What are the potential impacts of REDHAT-BUG-2416907?
The impacts of REDHAT-BUG-2416907 include possible application crashes and the execution of arbitrary code.