Executive Summary
| Summary | |
|---|---|
| Title | New libpng packages fix denial of service |
| Informations | |||
|---|---|---|---|
| Name | DSA-498 | First vendor Publication | 2004-04-30 |
| Vendor | Debian | Last vendor Modification | 2004-04-30 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Steve Grubb discovered a problem in the Portable Network Graphics library libpng which is utilised in several applications. When processing a broken PNG image, the error handling routine will access memory that is out of bounds when creating an error message. Depending on machine architecture, bounds checking and other protective measures, this problem could cause the program to crash if a defective or intentionally prepared PNG image file is handled by libpng. This could be used as a denial of service attack against various programs that link against this library. The following commands will show you which packages utilise this library and whose programs should probably restarted after an upgrade: apt-cache showpkg libpng2 apt-cache showpkg libpng3 The following security matrix explains which package versions will contain a correction. Package stable (woody) unstable (sid) libpng 1.0.12-3.woody.5 1.0.15-5 libpng3 1.2.1-1.1.woody.5 1.2.5.0-6 We recommend that you upgrade your libpng and related packages. |
Original Source
| Url : http://www.debian.org/security/2004/dsa-498 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-125 | Out-of-bounds Read |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11710 | |||
| Oval ID: | oval:org.mitre.oval:def:11710 | ||
| Title: | The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. | ||
| Description: | The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0421 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:971 | |||
| Oval ID: | oval:org.mitre.oval:def:971 | ||
| Title: | libpng Malformed PNG Image Vulnerability | ||
| Description: | The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0421 | Version: | 2 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-09-10 | Name : Slackware Advisory SSA:2011-210-01 libpng File : nvt/esoft_slk_ssa_2011_210_01.nasl |
| 2012-07-09 | Name : RedHat Update for libpng RHSA-2011:1105-01 File : nvt/gb_RHSA-2011_1105-01_libpng.nasl |
| 2012-04-11 | Name : Fedora Update for libpng10 FEDORA-2012-5079 File : nvt/gb_fedora_2012_5079_libpng10_fc15.nasl |
| 2012-04-02 | Name : Fedora Update for libpng10 FEDORA-2012-3536 File : nvt/gb_fedora_2012_3536_libpng10_fc15.nasl |
| 2012-03-07 | Name : Fedora Update for libpng10 FEDORA-2012-2008 File : nvt/gb_fedora_2012_2008_libpng10_fc15.nasl |
| 2011-10-21 | Name : Mandriva Update for libpng MDVSA-2011:151 (libpng) File : nvt/gb_mandriva_MDVSA_2011_151.nasl |
| 2011-08-02 | Name : Fedora Update for libpng FEDORA-2011-9336 File : nvt/gb_fedora_2011_9336_libpng_fc14.nasl |
| 2011-07-27 | Name : Fedora Update for libpng10 FEDORA-2011-8844 File : nvt/gb_fedora_2011_8844_libpng10_fc15.nasl |
| 2011-07-27 | Name : Fedora Update for libpng10 FEDORA-2011-8867 File : nvt/gb_fedora_2011_8867_libpng10_fc14.nasl |
| 2011-07-22 | Name : Fedora Update for libpng FEDORA-2011-9343 File : nvt/gb_fedora_2011_9343_libpng_fc15.nasl |
| 2011-07-18 | Name : Fedora Update for mingw32-libpng FEDORA-2011-8868 File : nvt/gb_fedora_2011_8868_mingw32-libpng_fc14.nasl |
| 2011-07-18 | Name : Fedora Update for mingw32-libpng FEDORA-2011-8874 File : nvt/gb_fedora_2011_8874_mingw32-libpng_fc15.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200405-06 (libpng) File : nvt/glsa_200405_06.nasl |
| 2008-09-04 | Name : FreeBSD Ports: linux-png File : nvt/freebsd_linux-png.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 498-1 (libpng, libpng3) File : nvt/deb_498_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2004-124-04 libpng update File : nvt/esoft_slk_ssa_2004_124_04.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 73493 | libpng pngerror.c png_format_buffer() Off-by-one PNG Image Handling Remote DoS |
| 5726 | libpng Malformed PNG Image Error Handling DoS libpng contains a flaw that may allow a remote denial of service. The issue is triggered when the library process a malformed PNG image and attempts to use memory it has not allocated for an error message. The application using the libpng library will crash resulting in loss of availability. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2011-10-18 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-151.nasl - Type : ACT_GATHER_INFO |
| 2011-08-01 | Name : The remote Fedora host is missing a security update. File : fedora_2011-9336.nasl - Type : ACT_GATHER_INFO |
| 2011-07-25 | Name : The remote Fedora host is missing a security update. File : fedora_2011-8844.nasl - Type : ACT_GATHER_INFO |
| 2011-07-25 | Name : The remote Fedora host is missing a security update. File : fedora_2011-8867.nasl - Type : ACT_GATHER_INFO |
| 2011-07-19 | Name : The remote Fedora host is missing a security update. File : fedora_2011-9343.nasl - Type : ACT_GATHER_INFO |
| 2011-07-18 | Name : The remote Fedora host is missing a security update. File : fedora_2011-8868.nasl - Type : ACT_GATHER_INFO |
| 2011-07-18 | Name : The remote Fedora host is missing a security update. File : fedora_2011-8874.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3a408f6f9c5211d893660020ed76ef5a.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-213.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2006-212.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-124-04.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-498.nasl - Type : ACT_GATHER_INFO |
| 2004-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200405-06.nasl - Type : ACT_GATHER_INFO |
| 2004-08-10 | Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd20040809.nasl - Type : ACT_GATHER_INFO |
| 2004-07-31 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-040.nasl - Type : ACT_GATHER_INFO |
| 2004-07-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-106.nasl - Type : ACT_GATHER_INFO |
| 2004-07-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-105.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote host is using an unsupported version of Mac OS X. File : macosx_version.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-180.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:33:17 |
|
