10 - RHSA-2004:402

Executive Summary

Summary
Title	Updated libpng packages fix security issues

Informations
Name	RHSA-2004:402	First vendor Publication	2004-08-04
Vendor	RedHat	Last vendor Modification	2004-08-04
Severity (Vendor)	N/A	Revision	01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated libpng packages that fix several issues are now available.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, ppc64, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

During a source code audit, Chris Evans discovered several buffer overflows in libpng. An attacker could create a carefully crafted PNG file in such a way that it would cause an application linked with libpng to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0597 to these issues.

In addition, this audit discovered a potential NULL pointer dereference in libpng (CAN-2004-0598) and several integer overflow issues (CAN-2004-0599). An attacker could create a carefully crafted PNG file in such a way that it would cause an application linked with libpng to crash when the file was opened by the victim.

Red Hat would like to thank Chris Evans for discovering these issues.

For users of Red Hat Enterprise Linux 2.1 these patches also include a more complete fix for the out of bounds memory access flaw (CAN-2002-1363).

All users are advised to update to the updated libpng packages which contain backported security patches and are not vulnerable to these issues.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/libpng-1.0.14-7.src.rpm 69bba6610f415bd0f21f815db1effbf2 libpng-1.0.14-7.src.rpm

i386: c660a4e7c583306a46a0134ab104f346 libpng-1.0.14-7.i386.rpm 7b2588d5cc492eb84a1c73729303ca4e libpng-devel-1.0.14-7.i386.rpm

ia64: 86e364114c5dedb33c5252b9a3fe6211 libpng-1.0.14-7.ia64.rpm 5201c1e26319d34fb8efa09256007152 libpng-devel-1.0.14-7.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/libpng-1.0.14-7.src.rpm 69bba6610f415bd0f21f815db1effbf2 libpng-1.0.14-7.src.rpm

ia64: 86e364114c5dedb33c5252b9a3fe6211 libpng-1.0.14-7.ia64.rpm 5201c1e26319d34fb8efa09256007152 libpng-devel-1.0.14-7.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/libpng-1.0.14-7.src.rpm 69bba6610f415bd0f21f815db1effbf2 libpng-1.0.14-7.src.rpm

i386: c660a4e7c583306a46a0134ab104f346 libpng-1.0.14-7.i386.rpm 7b2588d5cc492eb84a1c73729303ca4e libpng-devel-1.0.14-7.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/libpng-1.0.14-7.src.rpm 69bba6610f415bd0f21f815db1effbf2 libpng-1.0.14-7.src.rpm

i386: c660a4e7c583306a46a0134ab104f346 libpng-1.0.14-7.i386.rpm 7b2588d5cc492eb84a1c73729303ca4e libpng-devel-1.0.14-7.i386.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/libpng-1.2.2-25.src.rpm 1555047a805d476f63b705865ec6b1a1 libpng-1.2.2-25.src.rpm ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/libpng10-1.0.13-15.src.rpm 1a1c918f5d8054158036ff82bd6c8bc2 libpng10-1.0.13-15.src.rpm

i386: 63095ed0286c8978349ae94621887651 libpng-1.2.2-25.i386.rpm a79e3d8aac72561af368e5655c9dcb13 libpng-devel-1.2.2-25.i386.rpm 12464295e19c16d1474d1132bc90216e libpng10-1.0.13-15.i386.rpm 347af31b8620742e5e6b18de0c300d62 libpng10-devel-1.0.13-15.i386.rpm

ia64: 85c1fa0360af727b4b427aaac90861b7 libpng-1.2.2-25.ia64.rpm 63095ed0286c8978349ae94621887651 libpng-1.2.2-25.i386.rpm 5800ad160885273f270a6b8ecd0b9373 libpng-devel-1.2.2-25.ia64.rpm 811109452021a7f0bc9d25437caeab97 libpng10-1.0.13-15.ia64.rpm ba359cdb3db036a5b5b45c1a01b21791 libpng10-devel-1.0.13-15.ia64.rpm

ppc: cbf5617d15939c413b520fcbe0594485 libpng-1.2.2-25.ppc.rpm ddd78dd4e3439cb6cb28e5215e029a81 libpng-devel-1.2.2-25.ppc.rpm b0810e3f95590836652144165cd7e0cc libpng10-1.0.13-15.ppc.rpm d073fbeeef6874e0ae2238c6ef44ed6e libpng10-devel-1.0.13-15.ppc.rpm

ppc64: 5c7387ae952fcc1d4637e2655c9370a3 libpng-1.2.2-25.ppc64.rpm

s390: 0f621fbc3de1d8e4c4490e2baf2f30ef libpng-1.2.2-25.s390.rpm aec3463a236eac2d6d6576120f92eb55 libpng-devel-1.2.2-25.s390.rpm b4c3c6ee6d699fd51baf9f06f9275443 libpng10-1.0.13-15.s390.rpm afb0ebe6e191e7f71929d30788a11708 libpng10-devel-1.0.13-15.s390.rpm

s390x: f218fb58aee3535f3f0280c6c6a78dfa libpng-1.2.2-25.s390x.rpm 0f621fbc3de1d8e4c4490e2baf2f30ef libpng-1.2.2-25.s390.rpm 50d5ecfe73aa1f3a7ef0c41fb8fb79c6 libpng-devel-1.2.2-25.s390x.rpm 4b2733ffcb3d84295dcfecc36e69faaa libpng10-1.0.13-15.s390x.rpm edf03becdf0b2a6044c85896a005e1c3 libpng10-devel-1.0.13-15.s390x.rpm

x86_64: 80265ad8a377cf67f2906994e7b763af libpng-1.2.2-25.x86_64.rpm 63095ed0286c8978349ae94621887651 libpng-1.2.2-25.i386.rpm 188fec715d9a2129f28c775ad3917f7a libpng-devel-1.2.2-25.x86_64.rpm 006b451f489d3ec09ad39d23099ea0fb libpng10-1.0.13-15.x86_64.rpm e9a385e6c6c14d7575d84f045b01c054 libpng10-devel-1.0.13-15.x86_64.rpm

Red Hat Desktop version 3:

SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/libpng-1.2.2-25.src.rpm 1555047a805d476f63b705865ec6b1a1 libpng-1.2.2-25.src.rpm ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/libpng10-1.0.13-15.src.rpm 1a1c918f5d8054158036ff82bd6c8bc2 libpng10-1.0.13-15.src.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/libpng-1.2.2-25.src.rpm 1555047a805d476f63b705865ec6b1a1 libpng-1.2.2-25.src.rpm ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/libpng10-1.0.13-15.src.rpm 1a1c918f5d8054158036ff82bd6c8bc2 libpng10-1.0.13-15.src.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/libpng-1.2.2-25.src.rpm 1555047a805d476f63b705865ec6b1a1 libpng-1.2.2-25.src.rpm ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/libpng10-1.0.13-15.src.rpm 1a1c918f5d8054158036ff82bd6c8bc2 libpng10-1.0.13-15.src.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key.html#package

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2004-402.html

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10083

Oval ID:	oval:org.mitre.oval:def:10083
Title:	Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.
Description:	Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2002-1363	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section libpng10-devel is earlier than 0:1.0.13-15 AND libpng-devel is earlier than 2:1.2.2-25 AND libpng is earlier than 2:1.2.2-25 AND libpng10 is earlier than 0:1.0.13-15

Definition Id: oval:org.mitre.oval:def:10203

Oval ID:	oval:org.mitre.oval:def:10203
Title:	The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
Description:	The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0598	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section libpng10-devel is earlier than 0:1.0.13-15 AND libpng-devel is earlier than 2:1.2.2-25 AND libpng is earlier than 2:1.2.2-25 AND libpng10 is earlier than 0:1.0.13-15

Definition Id: oval:org.mitre.oval:def:10938

Oval ID:	oval:org.mitre.oval:def:10938
Title:	Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.
Description:	Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0599	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section mozilla-js-debugger is earlier than 37:1.4.3-3.0.2 AND libpng10-devel is earlier than 0:1.0.13-15 AND mozilla is earlier than 37:1.4.3-3.0.2 AND mozilla-chat is earlier than 37:1.4.3-3.0.2 AND libpng-devel is earlier than 2:1.2.2-25 AND mozilla-mail is earlier than 37:1.4.3-3.0.2 AND libpng10 is earlier than 0:1.0.13-15 AND mozilla-dom-inspector is earlier than 37:1.4.3-3.0.2 AND mozilla-nss is earlier than 37:1.4.3-3.0.2 AND mozilla-devel is earlier than 37:1.4.3-3.0.2 AND mozilla-nss-devel is earlier than 37:1.4.3-3.0.2 AND mozilla-nspr is earlier than 37:1.4.3-3.0.2 AND mozilla-nspr-devel is earlier than 37:1.4.3-3.0.2 AND libpng is earlier than 2:1.2.2-25

Definition Id: oval:org.mitre.oval:def:11284

Oval ID:	oval:org.mitre.oval:def:11284
Title:	Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Description:	Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0597	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section mozilla-js-debugger is earlier than 37:1.4.3-3.0.2 AND libpng10-devel is earlier than 0:1.0.13-15 AND mozilla is earlier than 37:1.4.3-3.0.2 AND mozilla-chat is earlier than 37:1.4.3-3.0.2 AND libpng-devel is earlier than 2:1.2.2-25 AND mozilla-mail is earlier than 37:1.4.3-3.0.2 AND libpng10 is earlier than 0:1.0.13-15 AND mozilla-dom-inspector is earlier than 37:1.4.3-3.0.2 AND mozilla-nss is earlier than 37:1.4.3-3.0.2 AND mozilla-devel is earlier than 37:1.4.3-3.0.2 AND mozilla-nss-devel is earlier than 37:1.4.3-3.0.2 AND mozilla-nspr is earlier than 37:1.4.3-3.0.2 AND mozilla-nspr-devel is earlier than 37:1.4.3-3.0.2 AND libpng is earlier than 2:1.2.2-25

Definition Id: oval:org.mitre.oval:def:1479

Oval ID:	oval:org.mitre.oval:def:1479
Title:	Integer Overflow in libpng via Malformed PNG Image
Description:	Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0599	Version:	1
Platform(s):	Sun Solaris 7	Product(s):	libpng
Definition Synopsis:
Solaris 7,8,or 9 installed Solaris 8 Installed AND Solaris 7 Installed AND Solaris 9 Installed AND Netscape installed

Definition Id: oval:org.mitre.oval:def:2274

Oval ID:	oval:org.mitre.oval:def:2274
Title:	Windows Messenger 5 libpng Buffer Overflow
Description:	Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0597	Version:	7
Platform(s):	Microsoft Windows 2000	Product(s):	Microsoft Data Access Components 2.8
Definition Synopsis:
NOT Windows Messenger 5.1 is installed AND the version of msmsgs.exe is less than 5.1.0.639

Definition Id: oval:org.mitre.oval:def:2378

Oval ID:	oval:org.mitre.oval:def:2378
Title:	Multiple Buffer Overflows in libpng
Description:	Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0597	Version:	1
Platform(s):	Sun Solaris 7	Product(s):	libpng
Definition Synopsis:
Solaris 7,8,or 9 installed Solaris 8 Installed AND Solaris 7 Installed AND Solaris 9 Installed AND Netscape installed

Definition Id: oval:org.mitre.oval:def:2572

Oval ID:	oval:org.mitre.oval:def:2572
Title:	DoS Vulnerability in libpng function png_handle_iCCP()
Description:	The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0598	Version:	1
Platform(s):	Sun Solaris 7	Product(s):	libpng
Definition Synopsis:
Solaris 7,8,or 9 installed Solaris 8 Installed AND Solaris 7 Installed AND Solaris 9 Installed AND Netscape installed

Definition Id: oval:org.mitre.oval:def:3657

Oval ID:	oval:org.mitre.oval:def:3657
Title:	Portable Network Graphics Library Offset Calculation Vulnerability
Description:	Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2002-1363	Version:	1
Platform(s):	Red Hat Enterprise Linux 3	Product(s):	libpng
Definition Synopsis:
Red Hat Enterprise 3 is installed AND libpng or libpng-devel rpm older than 1.2.2-24, Epoch 2 OR libpng10or libpng10-devel rpm older than 1.0.13-14, Epoch 0 libpng rpm older than 1.2.2-24, Epoch 2 AND libpng-devel rpm older than 1.2.2-24, Epoch 2 AND libpng10-devel rpm older than 1.0.13-14, Epoch 0 AND libpng10 rpm older than 1.0.13-14, Epoch 0

Definition Id: oval:org.mitre.oval:def:4492

Oval ID:	oval:org.mitre.oval:def:4492
Title:	Adobe Acrobat Reader libpng Buffer Overflow
Description:	Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0597	Version:	2
Platform(s):	Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows XP	Product(s):	Adobe Acrobat Reader
Definition Synopsis:
the software Adobe Acrobat Reader major version 6, minor version less than 3 is installed the software Adobe Acrobat Reader 6, major version 6 is installed AND the software Adobe Acrobat Reader 6, minor version less than 3 is installed

Definition Id: oval:org.mitre.oval:def:594

Oval ID:	oval:org.mitre.oval:def:594
Title:	Windows Messenger 6 libpng Buffer Overflow
Description:	Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0597	Version:	5
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP	Product(s):	MSN Messenger
Definition Synopsis:
MSN Messenger 6.2 is installed AND NOT MSN Messenger 6.2.0205 or later is installed

Definition Id: oval:org.mitre.oval:def:7709

Oval ID:	oval:org.mitre.oval:def:7709
Title:	libpng buffer overflow
Description:	Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2004-0597	Version:	9
Platform(s):	Microsoft Windows 98 Microsoft Windows ME Microsoft Windows NT Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7	Product(s):	MSN Messenger 4.7 MSN Messenger 6.1 MSN Messenger 6.2 Adobe Acrobat Reader
Definition Synopsis:
Windows Messenger 5.0 Microsoft Windows 2000 SP4, Windows Server 2003 (x86) Gold, Windows Server 2003 SP1 (x86), Windows XP Professional x64 Edition SP1, Windows XP SP1 (32-bit), Windows XP (x86) SP2 Microsoft Windows 2000 SP4 or later is installed AND Microsoft Windows Server 2003 (x86) Gold is installed AND Microsoft Windows Server 2003 SP1 (x86) is installed AND Microsoft Windows XP Professional x64 Edition SP1 is installed AND Microsoft Windows XP SP1 (32-bit) is installed AND Microsoft Windows XP (x86) SP2 is installed AND the version of msmsgs.exe is greater than or equal to 5.0.0.0 AND the version of msmsgs.exe is less than 5.1.0.639 OR Windows Messenger 4.7 on Windows XP SP1 32-bit Microsoft Windows XP SP1 (32-bit) is installed AND MSN Messenger 4.7 is installed AND the version of msmsgs.exe is less than 4.7.0.2010 OR Windows Messenger 4.7 on Windows XP SP2 (x86) Microsoft Windows XP (x86) SP2 is installed AND MSN Messenger 4.7 is installed AND the version of msmsgs.exe is less than 4.7.0.3001 OR MSN Messenger 6.1/6.2 MSN Messenger 6.1, MSN Messenger 6.2 MSN Messenger 6.1 is installed AND MSN Messenger 6.2 is installed AND NOT MSN Messenger 6.2.0205 or later is installed OR Adobe Acrobat Reader 6 the software Adobe Acrobat Reader 6, major version 6 is installed AND the software Adobe Acrobat Reader 6, minor version less than 3 is installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Greg Roelofs Libpng cpe:2.3:a:greg_roelofs:libpng:1.2.5:::::::* cpe:2.3:a:greg_roelofs:libpng:1.2.4:::::::* cpe:2.3:a:greg_roelofs:libpng:1.2.3:::::::* cpe:2.3:a:greg_roelofs:libpng:1.2.2:::::::* cpe:2.3:a:greg_roelofs:libpng:1.2.1:::::::* cpe:2.3:a:greg_roelofs:libpng:1.2.0:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.9:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.8:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.7:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.6:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.5:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.14:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.13:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.12:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.11:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0.10:::::::* cpe:2.3:a:greg_roelofs:libpng:1.0:::::::*	17
Application	Microsoft Msn Messenger cpe:2.3:a:microsoft:msn_messenger:6.2:::::::* cpe:2.3:a:microsoft:msn_messenger:6.1:::::::*	2
Application	Microsoft Windows Media Player cpe:2.3:a:microsoft:windows_media_player:9:::::::*	1
Application	Microsoft Windows Messenger cpe:2.3:a:microsoft:windows_messenger:5.0:::::::*	1
Os	Microsoft Windows 98Se cpe:2.3:o:microsoft:windows_98se::::::::	1
Os	Microsoft Windows Me cpe:2.3:o:microsoft:windows_me:::second_edition:::::*	1

OpenVAS Exploits

Date	Description
2008-09-24	Name : Gentoo Security Advisory GLSA 200407-06 (libpng) File : nvt/glsa_200407_06.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200408-03 (libpng) File : nvt/glsa_200408_03.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200408-22 (mozilla) File : nvt/glsa_200408_22.nasl
2008-09-04	Name : FreeBSD Ports: ImageMagick, ImageMagick-nox11 File : nvt/freebsd_ImageMagick3.nasl
2008-09-04	Name : FreeBSD Ports: png File : nvt/freebsd_png.nasl
2008-01-17	Name : Debian Security Advisory DSA 213-1 (libpng, libpng3) File : nvt/deb_213_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 536-1 (libpng) File : nvt/deb_536_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 570-1 (libpng) File : nvt/deb_570_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 571-1 (libpng3) File : nvt/deb_571_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2004-222-01 libpng File : nvt/esoft_slk_ssa_2004_222_01.nasl
0000-00-00	Name : Slackware Advisory SSA:2004-223-01 Mozilla File : nvt/esoft_slk_ssa_2004_223_01.nasl
0000-00-00	Name : Slackware Advisory SSA:2004-223-02 imagemagick File : nvt/esoft_slk_ssa_2004_223_02.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
8326	libpng png_handle_tRNS Remote Overflow A remote overflow exists in libpng. The library function png_handle_tRNS fails to perform a length check on PNG images resulting in a buffer overflow. With a specially crafted PNG file, an attacker can cause the execution of code resulting in a loss of integrity.
8316	libpng pngrutil.c Multiple Function Progressive Display Image Reading Overflow A potential local integer overflow exists in libpng. The library function png_push_read_chunk contains code that might be susceptible to integer overflows. It is currently unknown how dangerous this code might be. With a specially crafted request, an attacker might cause crashes or execution of code resulting in a loss of availability.
8315	libpng png_read_png Integer Overflow A local overflow exists in libpng. The library function png_read_png fails to validate the height of input PNG files resulting in a possible integer overflow. With a specially crafted request, an attacker might cause a crash of the applicatioin resulting in a loss of availability.
8314	libpng png_handle_sPLT Local Overflow A local overflow exists in libpng. The library function png_handle_sPLT fails to validate input resulting in a possible integer overflow. With a specially crafted request, an attacker might theoretically cause execution of code resulting in a loss of integrity.
8313	libpng png_handle_iCCP() Function NULL Pointer Dereference DoS A local overflow exists in libpng. The library function png_handle_iCCP fails to validate the input length from PNG files resulting in a possible NULL-pointer being referenced. With a specially crafted request, an attacker can cause denial of service which might result in a loss of availability for the application.
8312	libpng png_handle_sBIT() Local Overflow A local overflow exists in libpng. The library function png_handle_sBIT relies on checks in other functions to perform input validation resulting in a possible buffer overflow. With a specially crafted PNG file, an attacker might cause execution of code resulting in a loss of integrity.
7191	Portable Network Graphics Libraries libpng Row Buffer Overflow

Snort® IPS/IDS

Date	Description
2014-01-10	Microsoft Multiple Products PNG large image height download attempt RuleID : 3133-community - Revision : 15 - Type : FILE-IMAGE
2014-01-10	Microsoft Multiple Products PNG large image height download attempt RuleID : 3133 - Revision : 15 - Type : FILE-IMAGE
2014-01-10	libpng tRNS overflow attempt RuleID : 2673-community - Revision : 12 - Type : FILE-IMAGE
2014-01-10	libpng tRNS overflow attempt RuleID : 2673 - Revision : 12 - Type : FILE-IMAGE

Nessus® Vulnerability Scanner

Date	Description
2009-04-23	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_f9e3e60be65011d89b0a000347a4fa7d.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-213.nasl - Type : ACT_GATHER_INFO
2007-02-18	Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2006-212.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1-1.nasl - Type : ACT_GATHER_INFO
2005-07-13	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-223-01.nasl - Type : ACT_GATHER_INFO
2005-07-13	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-222-01.nasl - Type : ACT_GATHER_INFO
2005-07-13	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-223-02.nasl - Type : ACT_GATHER_INFO
2005-02-08	Name : Arbitrary code can be executed on the remote host through the Media Player. File : smb_nt_ms05-009.nasl - Type : ACT_GATHER_INFO
2004-11-10	Name : The remote Debian host is missing a security-related update. File : debian_DSA-571.nasl - Type : ACT_GATHER_INFO
2004-11-10	Name : The remote Debian host is missing a security-related update. File : debian_DSA-570.nasl - Type : ACT_GATHER_INFO
2004-09-29	Name : The remote Debian host is missing a security-related update. File : debian_DSA-536.nasl - Type : ACT_GATHER_INFO
2004-09-29	Name : The remote Debian host is missing a security-related update. File : debian_DSA-213.nasl - Type : ACT_GATHER_INFO
2004-08-30	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200407-06.nasl - Type : ACT_GATHER_INFO
2004-08-30	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200408-03.nasl - Type : ACT_GATHER_INFO
2004-08-30	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200408-22.nasl - Type : ACT_GATHER_INFO
2004-08-22	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-082.nasl - Type : ACT_GATHER_INFO
2004-08-22	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-079.nasl - Type : ACT_GATHER_INFO
2004-08-10	Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd20040809.nasl - Type : ACT_GATHER_INFO
2004-08-05	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-238.nasl - Type : ACT_GATHER_INFO
2004-08-05	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-237.nasl - Type : ACT_GATHER_INFO
2004-08-05	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-402.nasl - Type : ACT_GATHER_INFO
2004-08-05	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-421.nasl - Type : ACT_GATHER_INFO
2004-08-05	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-236.nasl - Type : ACT_GATHER_INFO
2004-08-05	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-239.nasl - Type : ACT_GATHER_INFO
2004-08-04	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2004_023.nasl - Type : ACT_GATHER_INFO
2004-07-31	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2003-008.nasl - Type : ACT_GATHER_INFO
2004-07-31	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-063.nasl - Type : ACT_GATHER_INFO
2004-07-25	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2003_0004.nasl - Type : ACT_GATHER_INFO
2004-07-06	Name : The remote host is using an unsupported version of Mac OS X. File : macosx_version.nasl - Type : ACT_GATHER_INFO
2004-07-06	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2003-007.nasl - Type : ACT_GATHER_INFO
2004-07-06	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2003-119.nasl - Type : ACT_GATHER_INFO
2004-07-06	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-249.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:48:35	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	12
CPE ID(s)	23
osvdb(s)	7
Openvas Exploit(s)	12
Snort® Rule(s)	4
Nessus® Exploit(s)	32

	Related
10	CVE-2004-0597
7.5	RHSA-2004:249
7.5	CVE-2002-1363
5	CVE-2004-0599
5	CVE-2004-0598
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 5 more Alert(s)

10 - RHSA-2004:402

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU