The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2007:0356 :

Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A flaw was found in the handling of malformed images in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was opened. (CVE-2006-5793)

Users of libpng should update to these updated packages which contain backported patches to correct these issues.

Red Hat would like to thank Glenn Randers-Pehrson, Mats Palmgren, and Tavis Ormandy for supplying details and patches for these issues.

The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.

This update to libpng 1.0.26 resolves this problem.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the handling of malformed images in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was opened. (CVE-2006-5793)

Several vulnerabilities have been discovered in libpng, a library for reading and writing PNG files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2445     The png_handle_tRNS function allows attackers to cause a     denial of service (application crash) via a grayscale     PNG image with a bad tRNS chunk CRC value.

  - CVE-2007-5269     Certain chunk handlers allow attackers to cause a denial     of service (crash) via crafted pCAL, sCAL, tEXt, iTXt,     and ztXT chunking in PNG images, which trigger     out-of-bounds read operations.

  - CVE-2008-1382     libpng allows context-dependent attackers to cause a     denial of service (crash) and possibly execute arbitrary     code via a PNG file with zero length 'unknown' chunks,     which trigger an access of uninitialized memory.

  - CVE-2008-5907     The png_check_keyword might allow context-dependent     attackers to set the value of an arbitrary memory     location to zero via vectors involving creation of     crafted PNG files with keywords.

  - CVE-2008-6218     A memory leak in the png_handle_tEXt function allows     context-dependent attackers to cause a denial of service     (memory exhaustion) via a crafted PNG file.

  - CVE-2009-0040     libpng allows context-dependent attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted PNG file that     triggers a free of an uninitialized pointer in (1) the     png_read_png function, (2) pCAL chunk handling, or (3)     setup of 16-bit gamma tables.

Multiple vulnerabilities have been identified in libgd2, a library for programmatic graphics creation and manipulation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2445     Grayscale PNG files containing invalid tRNS chunk CRC     values could cause a denial of service (crash), if a     maliciously crafted image is loaded into an application     using libgd.

  - CVE-2007-3476     An array indexing error in libgd's GIF handling could     induce a denial of service (crash with heap corruption)     if exceptionally large color index values are supplied     in a maliciously crafted GIF image file.

  - CVE-2007-3477     The imagearc() and imagefilledarc() routines in libgd     allow an attacker in control of the parameters used to     specify the degrees of arc for those drawing functions     to perform a denial of service attack (excessive CPU     consumption).

  - CVE-2007-3996     Multiple integer overflows exist in libgd's image     resizing and creation routines; these weaknesses allow     an attacker in control of the parameters passed to those     routines to induce a crash or execute arbitrary code     with the privileges of the user running an application     or interpreter linked against libgd2.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

Applications using libpng can crash if libpng is ask to process a grayscale image with a malformed (bad CRC) tRNS chunk. (CVE-2007-2445)

It was discovered that libpng did not correctly handle corrupted CRC in grayscale PNG images. By tricking a user into opening a specially crafted PNG, a remote attacker could cause the application using libpng to crash, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw how libpng handled malformed images was discovered. An attacker able to create a carefully crafted PNG image could cause an application linked with libpng to crash when the file was manipulated.

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200705-24 (libpng: Denial of Service)

    Mats Palmgren fixed an error in file pngrutil.c in which the trans[]     array might be not allocated because of images with a bad tRNS chunk     CRC value.
  Impact :

    A remote attacker could craft an image that when processed or viewed by     an application using libpng causes the application to terminate     abnormally.
  Workaround :

    There is no known workaround at this time.

Updated libpng packages that fix security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A flaw was found in the handling of malformed images in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was manipulated. (CVE-2007-2445)

A flaw was found in the sPLT chunk handling code in libpng. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash when the file was opened. (CVE-2006-5793)

Users of libpng should update to these updated packages which contain backported patches to correct these issues.

Red Hat would like to thank Glenn Randers-Pehrson, Mats Palmgren, and Tavis Ormandy for supplying details and patches for these issues.

A Libpng Security Advisory reports :

A grayscale PNG image with a malformed (bad CRC) tRNS chunk will crash some libpng applications.

This vulnerability could be used to crash a browser when a user tries to view such a malformed PNG file. It is not known whether the vulnerability could be exploited otherwise.

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and -current to fix a security issue.

GNOME 2.0.0_x86: libpng Patch.
Date this patch was last updated by Sun : Mar/19/12

GNOME 2.0.0: libpng Patch.
Date this patch was last updated by Sun : Mar/19/12

ID	Name	Product	Family	Severity
107983	Solaris 10 (x86) : 137081-10	Nessus	Solaris Local Security Checks	high
107982	Solaris 10 (x86) : 137081-09	Nessus	Solaris Local Security Checks	high
107981	Solaris 10 (x86) : 137081-07	Nessus	Solaris Local Security Checks	high
107485	Solaris 10 (sparc) : 137080-10	Nessus	Solaris Local Security Checks	high
107484	Solaris 10 (sparc) : 137080-09	Nessus	Solaris Local Security Checks	high
107483	Solaris 10 (sparc) : 137080-07	Nessus	Solaris Local Security Checks	high
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
67500	Oracle Linux 3 / 4 / 5 : libpng (ELSA-2007-0356)	Nessus	Oracle Linux Local Security Checks	medium
62266	Fedora 7 : libpng10-1.0.26-1.fc7.1 (2007-0004)	Nessus	Fedora Local Security Checks	medium
60184	Scientific Linux Security Update : libpng on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
35988	Debian DSA-1750-1 : libpng - several vulnerabilities	Nessus	Debian Local Security Checks	high
33552	Debian DSA-1613-1 : libgd2 - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
29508	SuSE 10 Security Update : libpng (ZYPP Patch Number 3740)	Nessus	SuSE Local Security Checks	medium
28073	Ubuntu 6.06 LTS / 6.10 / 7.04 : libpng vulnerability (USN-472-1)	Nessus	Ubuntu Local Security Checks	medium
27331	openSUSE 10 Security Update : libpng (libpng-3739)	Nessus	SuSE Local Security Checks	medium
27330	openSUSE 10 Security Update : libpng (libpng-3479)	Nessus	SuSE Local Security Checks	medium
25440	Mandrake Linux Security Advisory : libpng (MDKSA-2007:116)	Nessus	Mandriva Local Security Checks	medium
25383	GLSA-200705-24 : libpng: Denial of Service	Nessus	Gentoo Local Security Checks	medium
25269	RHEL 2.1 / 3 / 4 / 5 : libpng (RHSA-2007:0356)	Nessus	Red Hat Local Security Checks	medium
25261	FreeBSD : png -- DoS crash vulnerability (4cb9c513-03ef-11dc-a51d-0019b95d4f14)	Nessus	FreeBSD Local Security Checks	medium
25256	CentOS 3 / 4 / 5 : libpng (CESA-2007:0356)	Nessus	CentOS Local Security Checks	medium
25253	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 / current : libpng (SSA:2007-136-01)	Nessus	Slackware Local Security Checks	medium
23455	Solaris 8 (x86) : 114817-04	Nessus	Solaris Local Security Checks	medium
23367	Solaris 8 (sparc) : 114816-04	Nessus	Solaris Local Security Checks	medium

Detections

Analytics

CVE-2007-2445

high

Tenable Plugins

high

high

high

high

high

high

critical

medium

medium

medium

high

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium