USN-9082-1: pngquant vulnerability
Choi Jaeseung discovered that pngquant incorrectly handled certain PNG images, leading to a buffer overflow. An attacker could possibly use this issue to cause pngquant to crash or execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/pngquantto a version that resolves this vulnerability.Fixed in 2.5.0-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this issue?
An attacker would need to cause pngquant to process a specially crafted PNG image. Successful exploitation could crash pngquant or potentially allow arbitrary code execution.
Which deployments are exposed?
Deployments using pngquant to process untrusted or attacker-supplied PNG images are exposed to the described attack path. The provided information identifies Ubuntu's pngquant package but does not specify affected versions or configurations.