Vulnerability Note VU#819894

libpng invalid sCAL chunk processing vulnerability

Overview

libpng reads uninitialized memory when processing invalid sCAL chunks.

I. Description

When libpng encounters a sCAL chunk that is empty it will read uninitialized memory. libpng also does not properly handle a sCAL chunk that lacks the terminating zero between the two strings conveyed.

Additional details can be found on the png-mng-implement mailing list archives.

II. Impact

By tricking a user into opening a specifically crafted PNG file within an application that uses libpng, an attacker may be able to cause a denial of service crash.

III. Solution

Apply an Update

This vulnerability is addressed in the following libpng versions: libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55

Vendor Information

Vendor	Status	Date Notified	Date Updated
libpng	Affected	2011-07-07	2011-07-07

References

http://libpng.sourceforge.net/
http://sourceforge.net/mailarchive/forum.php?thread_name=003101cc2790%24fb5d6e80%24f2184b80%24%40acm.org&forum_name=png-mng-implement

Credit

Thanks to Glenn Randers-Pehrson for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

Date Public:	2011-07-07
Date First Published:	2011-07-07
Date Last Updated:	2011-07-07
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Severity Metric:	0.65
Document Revision:	10