Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler function is used to strip alpha channels out of the image.

The remote host is affected by the vulnerability described in GLSA-200812-15 (POV-Ray: User-assisted execution of arbitrary code)

    POV-Ray uses a statically linked copy of libpng to view and output PNG     files. The version shipped with POV-Ray is vulnerable to CVE-2008-3964,     CVE-2008-1382, CVE-2006-3334, CVE-2006-0481, CVE-2004-0768. A bug in     POV-Ray's build system caused it to load the old version when your     installed copy of libpng was >=media-libs/libpng-1.2.10.
  Impact :

    An attacker could entice a user to load a specially crafted PNG file as     a texture, resulting in the execution of arbitrary code with the     permissions of the user running the application.
  Workaround :

    There is no known workaround at this time.

Updated libpng packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A heap based buffer overflow bug was found in the way libpng strips alpha channels from a PNG image. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash or execute arbitrary code when the file is opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2006-0481 to this issue.

Please note that the vunerable libpng function is only used by TeTeX and XEmacs on Red Hat Enterprise Linux 4.

All users of libpng are advised to update to these updated packages which contain a backported patch that is not vulnerable to this issue.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2006:0205 advisory.

    The libpng package contains a library of functions for creating and     manipulating PNG (Portable Network Graphics) image format files.

    A heap based buffer overflow bug was found in the way libpng strips alpha     channels from a PNG image. An attacker could create a carefully crafted PNG     image file in such a way that it could cause an application linked with     libpng to crash or execute arbitrary code when the file is opened by a     victim. The Common Vulnerabilities and Exposures project has assigned the     name CVE-2006-0481 to this issue.

    Please note that the vunerable libpng function is only used by TeTeX and     XEmacs on Red Hat Enterprise Linux 4.

    All users of libpng are advised to update to these updated packages which     contain a backported patch that is not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
35107	GLSA-200812-15 : POV-Ray: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
21985	CentOS 4 : libpng (CESA-2006:0205)	Nessus	CentOS Local Security Checks	medium
20899	RHEL 4 : libpng (RHSA-2006:0205)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2006-0481

high

Tenable Plugins

high

medium

high