Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Dec 2015 11:56:47 -0500
From: Glenn Randers-Pehrson <>
Subject: Status of CVE-2015-8126: libpng buffer overflow in png_set_PLTE

On Thu, Nov 12, 2015 at 1:26 PM, Glenn Randers-Pehrson <>

> I request a CVE for a vulnerability in libpng, all versions, in the
> png_set_PLTE/png_get_PLTE functions.  These functions failed to check for
> an out-of-range palette when reading or writing PNG files with a bit_depth
> less than 8.  Some applications might read the bit depth from the IHDR
> chunk and allocate memory for a 2^N entry palette, while libpng can return
> a palette with up to 256 entries even when the bit depth is less than 8.
> libpng versions 1.6.19, 1.5.24, 1.4.17, 1.2.54, and 1.0.64 were released
> today (12 November 2015) to fix this vulnerability.  See

The patch was incomplete.  While it defended against the potential overrun
while reading PNG files, it did not detect a potential overrun by
applications using png_set_PLTE directly.  Libpng versions 1.6.20, 1.5.25,
1.4.18, 1.2.55, and 1.0.65 which were released today, December 3, 2015, fix
this remaining problem.

The PNG Development Group has not yet been made aware of any application
that is actually vulnerable to CVE-2015-8126. The original "crash" obtained
by fuzzing optipng had triggered an assert() that probably should have been
a warning; no out-of-bounds read occurs in optipng.


Glenn Randers-Pehrson
libpng custodian

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.