Buffer overflow in the progressive reader for libpng 1.2.x before 1.2.4, and 1.0.x before 1.0.14, allows attackers to cause a denial of service (crash) via a PNG data stream that has more IDAT data than indicated by the IHDR chunk.

Developers of the PNG library have fixed a buffer overflow in the progressive reader when the PNG datastream contains more IDAT data than indicated by the IHDR chunk. Such deliberately malformed datastreams would crash applications which could potentially allow an attacker to execute malicious code. Programs such as Galeon, Konqueror and various others make use of these libraries.

In addition to that, the packages below fix another potential buffer overflow. The PNG libraries implement a safety margin which is also included in a newer upstream release. Thanks to Glenn Randers-Pehrson for informing us.

To find out which packages depend on this library, you may want to execute the following commands :

    apt-cache showpkg libpng2 apt-cache showpkg libpng3

A buffer overflow was found in the in the progressive reader of the PNG library when the PNG datastream contains more IDAT data than indicated by the IHDR chunk. These deliberately malformed datastreams would crash applications thus potentially allowing an attacker to execute malicious code. Many programs make use of the PNG libraries, including web browsers. This overflow is corrected in versions 1.0.14 and 1.2.4 of the PNG library.

In order to have the system utilize the upgraded packages after the upgrade, you must restart all running applications that are linked to libpng. You can obtain this list by executing 'lsof|grep libpng' or 'fuser -v /usr/lib/libpng.so'.

Updated libpng packages are available that fix a buffer overflow vulnerability.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. PNG is a bit-mapped graphics format similar to the GIF format.

Versions of libpng prior to 1.0.14 contain a buffer overflow in the progressive reader when the PNG datastream contains more IDAT data than indicated by the IHDR chunk. Such deliberately malformed datastreams would crash applications linked to libpng such as Mozilla that use the progressive reading feature.

Packages within Red Hat Linux Advanced Server , such as Mozilla, make use of the shared libpng library, therefore all users are advised to upgrade to the errata packages which contain libpng 1.0.14. Libpng 1.0.14 is not vulnerable to this issue and contains fixes for other bugs including a number of memory leaks.

ID	Name	Product	Family	Severity
14977	Debian DSA-140-2 : libpng - buffer overflow	Nessus	Debian Local Security Checks	high
13952	Mandrake Linux Security Advisory : libpng (MDKSA-2002:049)	Nessus	Mandriva Local Security Checks	medium
12313	RHEL 2.1 : libpng (RHSA-2002:152)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2002-0728

high

Tenable Plugins

high

medium

high