It was reported [1] that libpng 1.5.4 suffered from a flaw when encountering a malformed cHRM chunk in a PNG graphics file. libpng would perform a divide-by-zero, which would cause libpng, or any application linked to libpng, to crash.

This flaw only affected libpng 1.5.4 where it was introduced, and is corrected in version 1.5.5. [2]

[1] http://www.kb.cert.org/vuls/id/477046 [2] http://sourceforge.net/tracker/index.php?func=detail&aid=3406145&groupid=5624&atid=105624

Statement:

Not vulnerable. This issue did not affect the versions of libpng as shipped with Red Hat Enterprise Linux 4, 5, or 6.

The sPLT chunk handling code (pngsetsPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.

Buffer overflow in the pngdecompresschunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to "chunk error processing," possibly involving the "chunkname".

Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the pngdostripfiller function is used to strip alpha channels out of the image.

Off-by-one buffer overflow in pnmtopng before 2.39, when using the -alpha command line option (AlphasOfColor), allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM file with exactly 256 colors.

libpng 1.2.5 and earlier does not properly calculate certain buffer offsets, which could allow remote attackers to execute arbitrary code via a buffer overflow attack.

Multiple integer overflows in the (1) pngreadpng in pngread.c or (2) pnghandlesPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.

Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the pnghandletRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) pnghandlesBIT or (3) pnghandlehIST functions do not perform sufficient bounds checking.

The pnghandleiCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.

From: Steve G <linux4ever>

In the pngformatbuffer function located in pngerror.c around line 133 is the following code:

if (message == NULL) buffer[iout] = 0; else { buffer[iout++] = ':'; buffer[iout++] = ' '; pngmemcpy(buffer+iout, message, 64); buffer[iout+63] = 0; } This code is called from the pngchunkerror & pngchunkwarning functions. An example of their use would be in pngutil.c around line 119. pngchunkerror(pngptr, "CRC error"); In the above code, the message being constructed is only 10 characters long. The pngmemcpy function will unconditionally access 54 bytes beyond the message.

This could cause a carefully crafted png image to cause a denial of service.

Possibly embargoed; marking as embargoed until communicated otherwise.

Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.

Buffer overflow in libpng 1.0.12-3.woody.2 and libpng3 1.2.1-1.1.woody.2 on Debian GNU/Linux 3.0, and other operating systems, may allow attackers to cause a denial of service and possibly execute arbitrary code, a different vulnerability than CVE-2002-0728.

Buffer overflow in the progressive reader for libpng 1.2.x before 1.2.4, and 1.0.x before 1.0.14, allows attackers to cause a denial of service (crash) via a PNG data stream that has more IDAT data than indicated by the IHDR chunk.