pngrtran.c in libpng before 1.0.29 and 1.2.x before 1.2.21 use (1) logical instead of bitwise operations and (2) incorrect comparisons, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG image.

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

SunOS 5.10_x86: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/17/17

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jun/15/17

SunOS 5.10: libpng Patch.
Date this patch was last updated by Sun : Jul/18/12

The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in AMD64 x86 emulation       base libraries. Please review the CVE identifiers referenced below for       details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

It was discovered that libpng did not properly perform bounds checking in certain operations. An attacker could send a specially crafted PNG image and cause a denial of service in applications linked against libpng. This issue only affected Ubuntu 8.04 LTS. (CVE-2007-5268, CVE-2007-5269)

Tavis Ormandy discovered that libpng did not properly initialize memory. If a user or automated system were tricked into opening a crafted PNG image, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue did not affect Ubuntu 8.10. (CVE-2008-1382)

Harald van Dijk discovered an off-by-one error in libpng. An attacker could could cause an application crash in programs using pngtest.
(CVE-2008-3964)

It was discovered that libpng did not properly NULL terminate a keyword string. An attacker could exploit this to set arbitrary memory locations to zero. (CVE-2008-5907)

Glenn Randers-Pehrson discovered that libpng did not properly initialize pointers. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-0040).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

New libpng packages are available for Slackware 10.1 and 10.2 that were left out of the last batch of updates.  These fix the same security problems as the other 1.2.23 upgrades.

More details about these issues may be found in the Common Vulnerabilities and Exposures (CVE) database:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5266   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5267   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5268   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5269

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues.

Multiple vulnerabilities were discovered in libpng :

An off-by-one error when handling ICC profile chunks in the png_set_iCCP() function (CVE-2007-5266; only affects Mandriva Linux 2008.0).

George Cook and Jeff Phillips reported several errors in pngrtran.c, such as the use of logical instead of bitwise functions and incorrect comparisons (CVE-2007-5268; only affects Mandriva Linux 2008.0).

Tavis Ormandy reported out-of-bounds read errors in several PNG chunk handling functions (CVE-2007-5269).

Updated packages have been patched to correct these issues. For Mandriva Linux 2008.0, libpng 1.2.22 is being provided which corrects all three issues.

It was discovered that libpng did not properly perform bounds checking and comparisons in certain operations. An attacker could send a specially crafted PNG image and cause a denial of service in applications linked against libpng.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200711-08 (libpng: Multiple Denials of Service)

    An off-by-one error when handling ICC profile chunks in the     png_set_iCCP() function was discovered (CVE-2007-5266). George Cook and     Jeff Phillips reported several errors in pngrtran.c, the use of logical     instead of a bitwise functions and incorrect comparisons     (CVE-2007-5268). Tavis Ormandy reported out-of-bounds read errors in     several PNG chunk handling functions (CVE-2007-5269).
  Impact :

    A remote attacker could craft an image that when processed or viewed by     an application using libpng would cause the application to terminate     abnormally.
  Workaround :

    There is no known workaround at this time.

A Secunia Advisory reports :

Some vulnerabilities have been reported in libpng, which can be exploited by malicious people to cause a DoS (Denial of Service).

Certain errors within libpng, including a logical NOT instead of a bitwise NOT in pngtrtran.c, an error in the 16bit cheap transparency extension, and an incorrect use of sizeof() may be exploited to crash an application using the library.

Various out-of-bounds read errors exist within the functions png_handle_pCAL(), png_handle_sCAL(), png_push_read_tEXt(), png_handle_iTXt(), and png_handle_ztXt(), which may be exploited by exploited to crash an application using the library.

The vulnerability is caused due to an off-by-one error within the ICC profile chunk handling, which potentially can be exploited to crash an application using the library.

ID	Name	Product	Family	Severity
107983	Solaris 10 (x86) : 137081-10	Nessus	Solaris Local Security Checks	high
107982	Solaris 10 (x86) : 137081-09	Nessus	Solaris Local Security Checks	high
107981	Solaris 10 (x86) : 137081-07	Nessus	Solaris Local Security Checks	high
107485	Solaris 10 (sparc) : 137080-10	Nessus	Solaris Local Security Checks	high
107484	Solaris 10 (sparc) : 137080-09	Nessus	Solaris Local Security Checks	high
107483	Solaris 10 (sparc) : 137080-07	Nessus	Solaris Local Security Checks	high
79964	GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)	Nessus	Gentoo Local Security Checks	critical
37042	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : libpng vulnerabilities (USN-730-1)	Nessus	Ubuntu Local Security Checks	high
32478	Mac OS X Multiple Vulnerabilities (Security Update 2008-003)	Nessus	MacOS X Local Security Checks	critical
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
28296	SSA-2007-325-01a libpng for Slackware 10.1 and 10.2	Nessus	Slackware Local Security Checks	medium
28295	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 8.1 / 9.0 / 9.1 / current : libpng (SSA:2007-325-01)	Nessus	Slackware Local Security Checks	medium
28200	Mandrake Linux Security Advisory : libpng (MDKSA-2007:217)	Nessus	Mandriva Local Security Checks	medium
28145	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : libpng vulnerabilities (USN-538-1)	Nessus	Ubuntu Local Security Checks	medium
27825	GLSA-200711-08 : libpng: Multiple Denials of Service	Nessus	Gentoo Local Security Checks	medium
26977	FreeBSD : png -- multiple vulnerabilities (172acf78-780c-11dc-b3f4-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-5268

high

Tenable Plugins

high

high

high

high

high

high

critical

high

critical

critical

critical

medium

medium

medium

medium

medium

medium