An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to
    the recommended error handling for png_read_image. (CVE-2018-14048)

  - An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based
    buffer overflow in the function get_token in pnm2png.c in pnm2png. (CVE-2018-14550)

  - png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function
    is called under png_safe_execute. (CVE-2019-7317)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based
    buffer overflow in the function get_token in pnm2png.c in pnm2png. (CVE-2018-14550)

An update of the syslinux package has been released.

According to the version of the libpng package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An issue has been found in third-party PNM decoding     associated with libpng 1.6.35. It is a stack-based     buffer overflow in the function get_token in pnm2png.c     in pnm2png.(CVE-2018-14550)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue has been found in third-party PNM decoding     associated with libpng 1.6.35. It is a stack-based     buffer overflow in the function get_token in pnm2png.c     in pnm2png.(CVE-2018-14550)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201908-02 (libpng: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libpng. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted PNG       file, could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

New libpng packages are available for Slackware 14.2 and -current to fix security issues.

ID	Name	Product	Family	Severity
424044	Alpine: multiple libpng packages: security update to 1.6.37-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424044	Alpine: multiple libpng packages: security update to 1.6.37-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
418388	SCA: security update for libpng (GHSA-qwwr-qc2p-6283)	Tenable Cloud Security	SCA Checks	high
418388	SCA: security update for libpng (GHSA-qwwr-qc2p-6283)	Tenable Self-Hosted Container Security	SCA Checks	high
204258	Photon OS 5.0: Syslinux PHSA-2023-5.0-0033	Nessus	PhotonOS Local Security Checks	critical
204103	Photon OS 3.0: Syslinux PHSA-2023-3.0-0602	Nessus	PhotonOS Local Security Checks	critical
203638	Photon OS 4.0: Syslinux PHSA-2023-4.0-0415	Nessus	PhotonOS Local Security Checks	critical
132832	EulerOS Virtualization for ARM 64 3.0.5.0 : libpng (EulerOS-SA-2020-1078)	Nessus	Huawei Local Security Checks	high
132608	EulerOS 2.0 SP8 : libpng (EulerOS-SA-2020-1015)	Nessus	Huawei Local Security Checks	high
127560	GLSA-201908-02 : libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
124140	Slackware 14.2 / current : libpng (SSA:2019-107-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2018-14550

high

Tenable Plugins

high

high

high

high

critical

critical

critical

high

high

high

high