Date: Thu, 3 Dec 2015 11:56:47 -0500 From: Glenn Randers-Pehrson <glennrp@...il.com> To: oss-security@...ts.openwall.com Subject: Status of CVE-2015-8126: libpng buffer overflow in png_set_PLTE On Thu, Nov 12, 2015 at 1:26 PM, Glenn Randers-Pehrson <glennrp@...il.com> wrote: > I request a CVE for a vulnerability in libpng, all versions, in the > png_set_PLTE/png_get_PLTE functions. These functions failed to check for > an out-of-range palette when reading or writing PNG files with a bit_depth > less than 8. Some applications might read the bit depth from the IHDR > chunk and allocate memory for a 2^N entry palette, while libpng can return > a palette with up to 256 entries even when the bit depth is less than 8. > > libpng versions 1.6.19, 1.5.24, 1.4.17, 1.2.54, and 1.0.64 were released > today (12 November 2015) to fix this vulnerability. See > libpng.sourceforge.net > The patch was incomplete. While it defended against the potential overrun while reading PNG files, it did not detect a potential overrun by applications using png_set_PLTE directly. Libpng versions 1.6.20, 1.5.25, 1.4.18, 1.2.55, and 1.0.65 which were released today, December 3, 2015, fix this remaining problem. The PNG Development Group has not yet been made aware of any application that is actually vulnerable to CVE-2015-8126. The original "crash" obtained by fuzzing optipng had triggered an assert() that probably should have been a warning; no out-of-bounds read occurs in optipng. Regards Glenn Randers-Pehrson libpng custodian
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ