Detections
Analytics
GLSA-201408-06 : libpng: Multiple vulnerabilities
medium Nessus Plugin ID 77213
Language:
Synopsis
The remote Gentoo host is missing one or more security-related patches.Description
The remote host is affected by the vulnerability described in GLSA-201408-06 (libpng: Multiple vulnerabilities)The png_push_read_chunk function in pngpread.c in the progressive decoder enters an infinite loop, when it encounters a zero-length IDAT chunk. In addition certain integer overflows have been detected and corrected.
The 1.2 branch is not affected by these vulnerabilities.
Impact :
A remote attacker could entice a user to open a specially crafted PNG file using an application linked against libpng, possibly resulting in Denial of Service.
Workaround :
There is no known workaround at this time.
Solution
All libpng users should upgrade to the latest version:# emerge --sync # emerge --ask --oneshot --verbose '>=media-libs/libpng-1.6.10' Users with current installs in the 1.5 branch should also upgrade this using:
# emerge --sync # emerge --ask --oneshot --verbose '>=media-libs/libpng-1.5.18:1.5' Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.
See Also
Plugin Details
Severity: Medium
ID: 77213
File Name: gentoo_GLSA-201408-06.nasl
Version: 1.5
Type: local
Family: Gentoo Local Security Checks
Published: 8/15/2014
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 4.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:gentoo:linux:libpng, cpe:/o:gentoo:linux
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Exploit Ease: No known exploits are available
Patch Publication Date: 8/14/2014
Reference Information
CVE: CVE-2013-7353, CVE-2013-7354, CVE-2014-0333
GLSA: 201408-06