According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The png_set_text_2 function in pngset.c in libpng 1.0.x     before 1.0.59, 1.2.x before 1.2.49, 1.4.x before     1.4.11, and 1.5.x before 1.5.10 allows remote attackers     to cause a denial of service (crash) or execute     arbitrary code via a crafted text chunk in a PNG image     file, which triggers a memory allocation failure that     is not properly handled, leading to a heap-based buffer     overflow.(CVE-2011-3048)

  - The png_handle_sCAL function in pngrutil.c in libpng     1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before     1.4.8, and 1.5.x before 1.5.4 does not properly handle     invalid sCAL chunks, which allows remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly have unspecified other     impact via a crafted PNG image that triggers the     reading of uninitialized memory.(CVE-2011-2692)

  - It was discovered that the png_get_PLTE() and     png_set_PLTE() functions of libpng did not correctly     calculate the maximum palette sizes for bit depths of     less than 8. In case an application tried to use these     functions in combination with properly calculated     palette sizes, this could lead to a buffer overflow or     out-of-bounds reads. An attacker could exploit this to     cause a crash or potentially execute arbitrary code by     tricking an unsuspecting user into processing a     specially crafted PNG image. However, the exact impact     is dependent on the application using the     library.(CVE-2015-8472)

  - The png_err function in pngerror.c in libpng 1.0.x     before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8,     and 1.5.x before 1.5.4 makes a function call using a     NULL pointer argument instead of an empty-string     argument, which allows remote attackers to cause a     denial of service (application crash) via a crafted PNG     image.(CVE-2011-2691)

  - Integer underflow in the png_check_keyword function in     pngwutil.c in libpng 0.90 through 0.99, 1.0.x before     1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x     before 1.4.19, and 1.5.x before 1.5.26 allows remote     attackers to have unspecified impact via a space     character as a keyword in a PNG image, which triggers     an out-of-bounds read.(CVE-2015-8540)

  - Integer overflow in libpng, as used in Google Chrome     before 17.0.963.56, allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via unknown vectors that trigger an integer     truncation.(CVE-2011-3026)

  - An array-indexing error was discovered in the     png_convert_to_rfc1123() function of libpng. An     attacker could possibly use this flaw to cause an     out-of-bounds read by tricking an unsuspecting user     into processing a specially crafted PNG     image.(CVE-2015-7981)

  - Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x     before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before     1.5.4, when used by an application that calls the     png_rgb_to_gray function but not the png_set_expand     function, allows remote attackers to overwrite memory     with an arbitrary amount of data, and possibly have     unspecified other impact, via a crafted PNG     image.(CVE-2011-2690)

  - The png_format_buffer function in pngerror.c in libpng     1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before     1.4.8, and 1.5.x before 1.5.4 allows remote attackers     to cause a denial of service (application crash) via a     crafted PNG image that triggers an out-of-bounds read     during the copying of error-message data. NOTE: this     vulnerability exists because of a CVE-2004-0421     regression. NOTE: this is called an off-by-one error by     some sources.(CVE-2011-2501)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the syslinux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x     before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application     crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message     data.  NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-     by-one error by some sources.(CVE-2011-2501)

    Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before     1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand     function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have     unspecified other impact, via a crafted PNG image.(CVE-2011-2690)

    The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8,     and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string     argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG     image.(CVE-2011-2691)

    The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x     before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote     attackers to cause a denial of service (memory corruption and application crash) or possibly have     unspecified other impact via a crafted PNG image that triggers the reading of uninitialized     memory.(CVE-2011-2692)

    Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used     in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of     service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different     vulnerability than CVE-2011-3026.(CVE-2011-3045)

    The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before     1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute     arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure     that is not properly handled, leading to a heap-based buffer overflow.(CVE-2011-3048)

    The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x     before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds     read) via a large avail_in field value in a PNG image.(CVE-2012-3425)

    The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x     before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME     chunk data in an image file, which triggers an out-of-bounds read.(CVE-2015-7981)

    Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64,     1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19     allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other     impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.(CVE-2015-8126)

    Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55,     1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause     a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth     value in an IHDR (aka image header) chunk in a PNG image.  NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-8126.(CVE-2015-8472)

    Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x     before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26     allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image,     which triggers an out-of-bounds read.(CVE-2015-8540)

    The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x     before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer     dereference vectors involving loading a text chunk into a png structure, removing the text, and then     adding another text chunk to the structure.(CVE-2016-10087)

    libpng before 1.6.32 does not properly check the length of chunks against the user limit.(CVE-2017-12652)

Tenable has extracted the preceding description block directly from the EulerOS syslinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the syslinux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x     before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer     dereference vectors involving loading a text chunk into a png structure, removing the text, and then     adding another text chunk to the structure.(CVE-2016-10087)

    The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x     before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds     read) via a large avail_in field value in a PNG image.(CVE-2012-3425)

    The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x     before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application     crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message     data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression.NOTE: this is called an off-     by-one error by some sources.(CVE-2011-2501)

    The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x     before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote     attackers to cause a denial of service (memory corruption and application crash) or possibly have     unspecified other impact via a crafted PNG image that triggers the reading of uninitialized     memory.(CVE-2011-2692)

    The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x     before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME     chunk data in an image file, which triggers an out-of-bounds read.(CVE-2015-7981)

    The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8,     and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string     argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG     image.(CVE-2011-2691)

    Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before     1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand     function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have     unspecified other impact, via a crafted PNG image.(CVE-2011-2690)

    The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before     1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute     arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure     that is not properly handled, leading to a heap-based buffer overflow.(CVE-2011-3048)

    Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used     in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of     service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different     vulnerability than CVE-2011-3026.(CVE-2011-3045)

    Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64,     1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19     allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other     impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.(CVE-2015-8126)

    Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x     before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26     allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image,     which triggers an out-of-bounds read.(CVE-2015-8540)

    Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55,     1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause     a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth     value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-8126.(CVE-2015-8472)

    libpng before 1.6.32 does not properly check the length of chunks against the user limit.(CVE-2017-12652)

Tenable has extracted the preceding description block directly from the EulerOS syslinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been discovered and corrected in libpng :

The png_format_buffer function in pngerror.c in libpng allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression (CVE-2011-2501).

Buffer overflow in libpng, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image (CVE-2011-2690).

The png_err function in pngerror.c in libpng makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image (CVE-2011-2691). NOTE:
This does not affect the binary packages in Mandriva, but could affect users if PNG_NO_ERROR_TEXT is defined using the libpng-source-1.?.?? package.

The png_handle_sCAL function in pngrutil.c in libpng does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory (CVE-2011-2692).

The updated packages have been patched to correct these issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1105 advisory.

    [2:1.2.46-1]
    - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690,       CVE-2011-2691, CVE-2011-2692     Resolves: #721305

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
124924	EulerOS Virtualization 3.0.1.0 : libpng (EulerOS-SA-2019-1421)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	high
210631	EulerOS 2.0 SP9 : syslinux (EulerOS-SA-2024-2839)	Nessus	Huawei Local Security Checks	2024/11/8	2024/11/8	critical
210632	EulerOS 2.0 SP10 : syslinux (EulerOS-SA-2024-2915)	Nessus	Huawei Local Security Checks	2024/11/8	2024/11/8	critical
56529	Mandriva Linux Security Advisory : libpng (MDVSA-2011:151)	Nessus	Mandriva Local Security Checks	2011/10/18	2021/1/6	medium
68318	Oracle Linux 6 : libpng (ELSA-2011-1105)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high

检测

插件搜索

high

critical

critical

medium

high