Speciall crafted png files could crash applications when attempting to open such a file (CVE-2007-5269).

- Thu Oct 18 2007 Tom Lane <tgl at redhat.com> 2:1.2.22-1

    - Update to libpng 1.2.22, primarily to fix       CVE-2007-5269 Related: #324771

  - Update License tag

    - Wed May 23 2007 Tom Lane <tgl at redhat.com>       2:1.2.16-2

    - Add patch to fix CVE-2007-2445 Related: #239542

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several flaws were discovered in the way libpng handled various PNG image chunks. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-5269)

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

Several vulnerabilities have been discovered in libpng, a library for reading and writing PNG files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2445     The png_handle_tRNS function allows attackers to cause a     denial of service (application crash) via a grayscale     PNG image with a bad tRNS chunk CRC value.

  - CVE-2007-5269     Certain chunk handlers allow attackers to cause a denial     of service (crash) via crafted pCAL, sCAL, tEXt, iTXt,     and ztXT chunking in PNG images, which trigger     out-of-bounds read operations.

  - CVE-2008-1382     libpng allows context-dependent attackers to cause a     denial of service (crash) and possibly execute arbitrary     code via a PNG file with zero length 'unknown' chunks,     which trigger an access of uninitialized memory.

  - CVE-2008-5907     The png_check_keyword might allow context-dependent     attackers to set the value of an arbitrary memory     location to zero via vectors involving creation of     crafted PNG files with keywords.

  - CVE-2008-6218     A memory leak in the png_handle_tEXt function allows     context-dependent attackers to cause a denial of service     (memory exhaustion) via a crafted PNG file.

  - CVE-2009-0040     libpng allows context-dependent attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted PNG file that     triggers a free of an uninitialized pointer in (1) the     png_read_png function, (2) pCAL chunk handling, or (3)     setup of 16-bit gamma tables.

It was discovered that libpng did not properly perform bounds checking in certain operations. An attacker could send a specially crafted PNG image and cause a denial of service in applications linked against libpng. This issue only affected Ubuntu 8.04 LTS. (CVE-2007-5268, CVE-2007-5269)

Tavis Ormandy discovered that libpng did not properly initialize memory. If a user or automated system were tricked into opening a crafted PNG image, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue did not affect Ubuntu 8.10. (CVE-2008-1382)

Harald van Dijk discovered an off-by-one error in libpng. An attacker could could cause an application crash in programs using pngtest.
(CVE-2008-3964)

It was discovered that libpng did not properly NULL terminate a keyword string. An attacker could exploit this to set arbitrary memory locations to zero. (CVE-2008-5907)

Glenn Randers-Pehrson discovered that libpng did not properly initialize pointers. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0040).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libpng did not properly perform bounds checking and comparisons in certain operations. An attacker could send a specially crafted PNG image and cause a denial of service in applications linked against libpng.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in libpng :

An off-by-one error when handling ICC profile chunks in the png_set_iCCP() function (CVE-2007-5266; only affects Mandriva Linux 2008.0).

George Cook and Jeff Phillips reported several errors in pngrtran.c, such as the use of logical instead of bitwise functions and incorrect comparisons (CVE-2007-5268; only affects Mandriva Linux 2008.0).

Tavis Ormandy reported out-of-bounds read errors in several PNG chunk handling functions (CVE-2007-5269).

Updated packages have been patched to correct these issues. For Mandriva Linux 2008.0, libpng 1.2.22 is being provided which corrects all three issues.

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

VMware products installed on the remote host are affected by multiple vulnerabilities :

  - The 'authd' process is affected by a privilege     escalation vulnerability that could allow an attacker to     execute arbitrary code with system level privileges or     cause a denial of service condition.

  - A feature in VMware workstation version 6.0.2 could     allow anonymous console access to guest host via VIX     API, which could result in unauthorized access. This     feature has been disabled in version 6.0.3.

  - Windows based VMware hosts are affected by a privilege     escalation vulnerability. By manipulating 'config.ini'     an attacker may be able to gain elevated privileges by     hijacking the VMware VMX process.

  - Multiple VMware products are affected by a directory     traversal vulnerability. If a Windows based VMware host     is configured to allow shared access from a guest host     to a folder on the Host system (HGFS), it may be     possible     to gain access to the Host file system from guest OS and     create/modify arbitrary executable files. VMware Server     is not affected by this vulnerability.

  - Multiple VMware products hosted on a Windows 2000 host     are affected by a privilege escalation vulnerability.

  - Multiple VMware products are vulnerable to a potential     denial of service attack.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
28326	openSUSE 10 Security Update : libpng (libpng-4628)	Nessus	SuSE Local Security Checks	2007/11/26	2021/1/14	medium
27787	Fedora 7 : libpng-1.2.22-1.fc7 (2007-2666)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	medium
60275	Scientific Linux Security Update : libpng on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
107485	Solaris 10 (sparc) : 137080-10	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
35988	Debian DSA-1750-1 : libpng - several vulnerabilities	Nessus	Debian Local Security Checks	2009/3/23	2021/1/4	high
37042	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : libpng vulnerabilities (USN-730-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	high
60274	Scientific Linux Security Update : libpng on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
28145	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : libpng vulnerabilities (USN-538-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
28200	Mandrake Linux Security Advisory : libpng (MDKSA-2007:217)	Nessus	Mandriva Local Security Checks	2007/11/14	2021/1/6	medium
107484	Solaris 10 (sparc) : 137080-09	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
107981	Solaris 10 (x86) : 137081-07	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2008/5/29	2024/5/28	critical
107982	Solaris 10 (x86) : 137081-09	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	high
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	2008/3/19	2018/7/14	critical
31729	VMware Products Multiple Vulnerabilities (VMSA-2008-0005)	Nessus	Windows	2008/4/2	2024/3/27	high

检测

插件搜索

medium

medium

medium

high

high

high

medium

medium

medium

high

high

critical

high

critical

high