This update fixes the way that libpng10 handles unknown zero-length chunks, which in previous versions could result in writing to attacker controlled addresses, depending on how the libpng api is used. To be affected, an application would have to call png_set_keep_unknown_chunks(), which tells libpng not to ignore unknown chunks, but to do something with them. The PNG spec allows for 'unknown' chunks, which are ignored by default, but an application could in theory embed some sort of extra data in a png image, then later get it back out via this mechanism. No packages in Fedora are believed to be affected by this issue, but it's possible that third-party applications could be.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream version 1.2.29. Among other bug fixes, this introduces a minor security fix in the handling of unknown chunks - CVE-2008-1382: http://libpng.sourceforge.net/Advisory-1.2.26.txt http://www.ocert.org/advisories/ocert-2008-003.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0333 advisory.

    The libpng packages contain a library of functions for creating and     manipulating PNG (Portable Network Graphics) image format files.

    A flaw was discovered in libpng that could result in libpng trying to     free() random memory if certain, unlikely error conditions occurred. If a     carefully-crafted PNG file was loaded by an application linked against     libpng, it could cause the application to crash or, potentially, execute     arbitrary code with the privileges of the user running the application.
    (CVE-2009-0040)

    A flaw was discovered in the way libpng handled PNG images containing     unknown chunks. If an application linked against libpng attempted to     process a malformed, unknown chunk in a malicious PNG image, it could cause     the application to crash. (CVE-2008-1382)

    Users of libpng and libpng10 should upgrade to these updated packages,     which contain backported patches to correct these issues. All running     applications using libpng or libpng10 must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0333 advisory.

    [1.2.10-7.1.el5_3.2]
    - Back-port fixes for CVE-2008-1382 and CVE-2009-0040.
    Resolves: #487168

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix a security issue.

Secunia reports :

Tavis Ormandy has reported a vulnerability in libpng, which can be exploited by malicious people to cause a Denial of Service, disclose potentially sensitive information, or potentially compromise an application using the library.

The vulnerability is caused due to the improper handling of PNG chunks unknown to the library. This can be exploited to trigger the use of uninitialized memory in e.g. a free() call via unknown PNG chunks having a length of zero.

Successful exploitation may allow execution of arbitrary code, but requires that the application calls the png_set_read_user_chunk_fn() function or the png_set_keep_unknown_chunks() function under specific conditions.

It was discovered that libpng did not properly perform bounds checking in certain operations. An attacker could send a specially crafted PNG image and cause a denial of service in applications linked against libpng. This issue only affected Ubuntu 8.04 LTS. (CVE-2007-5268, CVE-2007-5269)

Tavis Ormandy discovered that libpng did not properly initialize memory. If a user or automated system were tricked into opening a crafted PNG image, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue did not affect Ubuntu 8.10. (CVE-2008-1382)

Harald van Dijk discovered an off-by-one error in libpng. An attacker could could cause an application crash in programs using pngtest.
(CVE-2008-3964)

It was discovered that libpng did not properly NULL terminate a keyword string. An attacker could exploit this to set arbitrary memory locations to zero. (CVE-2008-5907)

Glenn Randers-Pehrson discovered that libpng did not properly initialize pointers. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0040).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

a. VMware Descheduled Time Accounting driver vulnerability may cause a    denial of service in Windows based virtual machines.

   The VMware Descheduled Time Accounting Service is an optional,    experimental service that provides improved guest operating system    accounting.

   This patch fixes a denial of service vulnerability that could be    triggered in a virtual machine by an unprivileged, locally    logged-on user in the virtual machine.

   Virtual machines are affected under the following conditions :

   - The virtual machine is running a Windows operating system.

   - The VMware Descheduled Time Accounting driver is installed      in the virtual machine. Note that this is an optional (non-      default) part of the VMware Tools installation.

   - The VMware Descheduled Time Accounting Service is not running      in the virtual machine

   The VMware Descheduled Time Accounting Service is no longer provided    in newer versions of VMware Tools, starting with the versions    released in Fusion 2.0.2 and ESX 4.0.

   However, virtual machines migrated from vulnerable releases will    still be vulnerable if the three conditions listed above are met,    until their tools are upgraded.

   Steps needed to remediate this vulnerability :

   Guest systems on VMware Workstation, Player, ACE, Server, Fusion
    - Install the new version of Workstation, Player, ACE, Server,       Fusion (see below for version information)
    - Upgrade tools in the virtual machine (virtual machine users       will be prompted to upgrade).

   Guest systems on ESX 3.5, ESXi 3.5, ESX 3.0.2, ESX 3.0.3
    - Install the relevant patches (see below for patch identifiers)
    - Manually upgrade tools in the virtual machine (virtual machine       users will not be prompted to upgrade).  Note the VI Client will       not show the VMware tools is out of date in the summary tab.
      Please see http://tinyurl.com/27mpjo page 80 for details.

   Guests systems on ESX 4.0 and ESXi 4.0 that have been migrated from    ESX 3.5, ESXi 3.5, and ESX 3.0.x
    - Install/upgrade the new tools in the virtual machine (virtual       machine users will be prompted to upgrade).

   If the Descheduled Time Accounting driver was installed, the tools    upgrade will result in an updated driver for Workstation, Player,    ACE, Server, ESX 3.0.2, ESX 3.0.3, ESX 3.5, ESXi 3.5. For Fusion,    ESX 4.0, and ESXi 4.0 the tools upgrade will result in the removal    of the driver.

   VMware would like to thank Nikita Tarakanov for reporting this    issue to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-1805 to this issue.

b. Updated libpng package for the ESX 2.5.5 Service Console

   The libpng packages contain a library of functions for creating and    manipulating PNG (Portable Network Graphics) image format files.

   A flaw was discovered in libpng that could result in libpng trying    to free() random memory if certain, unlikely error conditions    occurred. If a carefully-crafted PNG file was loaded by an    application linked against libpng, it could cause the application    to crash or, potentially, execute arbitrary code with the    privileges of the user running the application.

   A flaw was discovered in the way libpng handled PNG images    containing 'unknown' chunks. If an application linked against libpng    attempted to process a malformed, unknown chunk in a malicious PNG    image, it could cause the application to crash.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-0040 and CVE-2008-1382 to these    issues.

   The VMware version number of libpng after applying the update is    libpng-1.0.14-12.i386.rpm.

Specially crafted PNG files could overwrite arbitrary memory.
Attackers could potentially exploit that to execute arbitrary code.
(CVE-2008-1382)

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-006 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.7. 

Mac OS X 10.5.7 contains security fixes for the following products :

  - Apache
  - ATS
  - BIND
  - CFNetwork
  - CoreGraphics
  - Cscope
  - CUPS
  - Disk Images
  - enscript
  - Flash Player plug-in
  - Help Viewer
  - iChat
  - International Components for Unicode
  - IPSec
  - Kerberos
  - Kernel
  - Launch Services
  - libxml
  - Net-SNMP
  - Network Time
  - Networking
  - OpenSSL
  - PHP
  - QuickDraw Manager
  - ruby
  - Safari
  - Spotlight
  - system_cmds
  - telnet
  - Terminal
  - WebKit
  - X11

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

The remote host is affected by the vulnerability described in GLSA-200812-15 (POV-Ray: User-assisted execution of arbitrary code)

    POV-Ray uses a statically linked copy of libpng to view and output PNG     files. The version shipped with POV-Ray is vulnerable to CVE-2008-3964,     CVE-2008-1382, CVE-2006-3334, CVE-2006-0481, CVE-2004-0768. A bug in     POV-Ray's build system caused it to load the old version when your     installed copy of libpng was >=media-libs/libpng-1.2.10.
  Impact :

    An attacker could entice a user to load a specially crafted PNG file as     a texture, resulting in the execution of arbitrary code with the     permissions of the user running the application.
  Workaround :

    There is no known workaround at this time.

Specially crafted png files could overwrite arbitrary memory.
Attackers could potentially exploit that to execute arbitrary code (CVE-2008-1382).

Updated libpng and libpng10 packages that fix a couple of security issues are now available for Red Hat Enterprise Linux 2.1, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A flaw was discovered in libpng that could result in libpng trying to free() random memory if certain, unlikely error conditions occurred.
If a carefully-crafted PNG file was loaded by an application linked against libpng, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-0040)

A flaw was discovered in the way libpng handled PNG images containing 'unknown' chunks. If an application linked against libpng attempted to process a malformed, unknown chunk in a malicious PNG image, it could cause the application to crash. (CVE-2008-1382)

Users of libpng and libpng10 should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using libpng or libpng10 must be restarted for the update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
32458	Fedora 9 : libpng10-1.0.37-1.fc9 (2008-3683)	Nessus	Fedora Local Security Checks	2008/5/29	2021/1/11	high
33079	Fedora 8 : libpng-1.2.29-1.fc8 (2008-4847)	Nessus	Fedora Local Security Checks	2008/6/4	2021/1/11	high
35775	RHEL 4 / 5 : libpng (RHSA-2009:0333)	Nessus	Red Hat Local Security Checks	2009/3/5	2024/11/4	critical
67815	Oracle Linux 5 : libpng (ELSA-2009-0333)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
32083	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 8.1 / 9.0 / 9.1 / current : libpng (SSA:2008-119-01)	Nessus	Slackware Local Security Checks	2008/5/1	2021/1/14	high
32110	FreeBSD : png -- unknown chunk processing uninitialized memory access (57c705d6-12ae-11dd-bab7-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	2008/5/1	2021/1/6	high
32460	Fedora 7 : libpng10-1.0.37-1.fc7 (2008-3979)	Nessus	Fedora Local Security Checks	2008/5/29	2021/1/11	high
37042	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : libpng vulnerabilities (USN-730-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	high
40392	VMSA-2009-0007 : VMware Hosted products and ESX and ESXi patches resolve security issues	Nessus	VMware ESX Local Security Checks	2009/7/27	2021/1/6	high
41209	SuSE9 Security Update : libpng (YOU Patch Number 12141)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
34210	Mac OS X Multiple Vulnerabilities (Security Update 2008-006)	Nessus	MacOS X Local Security Checks	2008/9/16	2024/5/28	critical
38744	Mac OS X 10.5.x < 10.5.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2009/5/13	2024/5/28	critical
107485	Solaris 10 (sparc) : 137080-10	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/24	high
107982	Solaris 10 (x86) : 137081-09	Nessus	Solaris Local Security Checks	2018/3/12	2025/10/22	high
35107	GLSA-200812-15 : POV-Ray: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2008/12/15	2021/1/6	high
40036	openSUSE Security Update : libpng-devel (libpng-devel-66)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
43731	CentOS 4 : libpng (CESA-2009:0333)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	high

检测

插件搜索

high

high

critical

critical

high

high

high

high

high

high

critical

critical

high

high

high

high

high