[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Dec 2015 11:56:47 -0500
From: Glenn Randers-Pehrson <glennrp@...il.com>
To: oss-security@...ts.openwall.com
Subject: Status of CVE-2015-8126: libpng buffer overflow in png_set_PLTE
On Thu, Nov 12, 2015 at 1:26 PM, Glenn Randers-Pehrson <glennrp@...il.com>
wrote:
> I request a CVE for a vulnerability in libpng, all versions, in the
> png_set_PLTE/png_get_PLTE functions. These functions failed to check for
> an out-of-range palette when reading or writing PNG files with a bit_depth
> less than 8. Some applications might read the bit depth from the IHDR
> chunk and allocate memory for a 2^N entry palette, while libpng can return
> a palette with up to 256 entries even when the bit depth is less than 8.
>
> libpng versions 1.6.19, 1.5.24, 1.4.17, 1.2.54, and 1.0.64 were released
> today (12 November 2015) to fix this vulnerability. See
> libpng.sourceforge.net
>
The patch was incomplete. While it defended against the potential overrun
while reading PNG files, it did not detect a potential overrun by
applications using png_set_PLTE directly. Libpng versions 1.6.20, 1.5.25,
1.4.18, 1.2.55, and 1.0.65 which were released today, December 3, 2015, fix
this remaining problem.
The PNG Development Group has not yet been made aware of any application
that is actually vulnerable to CVE-2015-8126. The original "crash" obtained
by fuzzing optipng had triggered an assert() that probably should have been
a warning; no out-of-bounds read occurs in optipng.
Regards
Glenn Randers-Pehrson
libpng custodian
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
