This script is Copyright (C) 2008-2015 Tenable Network Security, Inc.
The remote Fedora host is missing a security update.
This update fixes the way that libpng10 handles unknown zero-length
chunks, which in previous versions could result in writing to attacker
controlled addresses, depending on how the libpng api is used. To be
affected, an application would have to call
png_set_keep_unknown_chunks(), which tells libpng not to ignore
unknown chunks, but to do something with them. The PNG spec allows for
'unknown' chunks, which are ignored by default, but an application
could in theory embed some sort of extra data in a png image, then
later get it back out via this mechanism. No packages in Fedora are
believed to be affected by this issue, but it's possible that
third-party applications could be.
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.
See also :
Update the affected libpng10 package.
Risk factor :
High / CVSS Base Score : 7.5
CVSS Temporal Score : 6.5
Public Exploit Available : false