REDHAT-BUG-720607: Medium severity libpng vulnerability
libpng overwrites unallocated memory when promoting a paletted image with transparency (one channel) to gray-alpha (two channels), only if the application calls pngrgbtogray() but fails to call pngsetexpand().
This bug exists in all released versions of libpng (1.0, 1.2, 1.4 and 1.5). The data overwritten is entirely controlled by the image data in the PNG file and it is possible to cause any string of data to be written by fabricating an appropriate PNG file. The amount of overwrite is equal to the row length of the original image.
This has been fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-720607?
The severity of REDHAT-BUG-720607 is considered critical due to the potential for memory corruption.
How do I fix REDHAT-BUG-720607?
To fix REDHAT-BUG-720607, applications must ensure that they call png_set_expand() before calling png_rgb_to_gray() when promoting paletted images.
Which versions of libpng are affected by REDHAT-BUG-720607?
All released versions of libpng, including 1.0, 1.2, 1.4, and 1.5, are affected by REDHAT-BUG-720607.
What is the root cause of REDHAT-BUG-720607?
The root cause of REDHAT-BUG-720607 is the overwriting of unallocated memory when the necessary expansion functions are not called during image format promotion.
Is REDHAT-BUG-720607 present in any specific applications?
Yes, REDHAT-BUG-720607 can be present in any application that utilizes affected versions of libpng without following proper usage practices.