REDHAT-BUG-2428824: Medium severity libpng LIBPNG vulnerability
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions pngwriteimage16bit and pngwriteimage8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpngto a version that resolves this vulnerability.Fixed in 1.6.54
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2428824?
The severity of REDHAT-BUG-2428824 is classified as moderate due to potential heap buffer overflow vulnerabilities.
How do I fix REDHAT-BUG-2428824?
To fix REDHAT-BUG-2428824, update libpng to version 1.6.54 or later.
What versions of libpng are affected by REDHAT-BUG-2428824?
Versions of libpng from 1.6.26 to 1.6.53 are affected by REDHAT-BUG-2428824.
What are the risks associated with REDHAT-BUG-2428824?
The risks associated with REDHAT-BUG-2428824 include potential exploitation leading to remote code execution.
Is there a workaround for REDHAT-BUG-2428824 until I can update?
There are no known effective workarounds for REDHAT-BUG-2428824, so it is recommended to update libpng as soon as possible.