First published: Tue Jul 12 2011(Updated: )
It was found that in libpng, prior to 1.2.45, the error function received a NULL pointer, expressed erroneously as '\0', instead of the empty string "". This error was introduced in libpng-1.2.20, and png_default_error() will crash in this case. This was be fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55. Patch: <a href="http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9dad5e37aef295b4ef8dea39392b652deebc9261">http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9dad5e37aef295b4ef8dea39392b652deebc9261</a>
Affected Software | Affected Version | How to fix |
---|---|---|
libpng | <1.2.45 | |
libpng | >=1.2.20<1.5.4 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of REDHAT-BUG-720608 is considered high as it can lead to a crash in applications using the affected versions of libpng.
To fix REDHAT-BUG-720608, upgrade to libpng version 1.5.4 or later.
Versions of libpng prior to 1.2.45 and those between 1.2.20 and 1.5.4 are affected by REDHAT-BUG-720608.
Using an affected version of libpng can cause the png_default_error() function to crash when a NULL pointer is passed.
As of now, there is no publicly available exploit specifically targeting REDHAT-BUG-720608.