RHEL 2.1 / 3 : libpng (RHSA-2004:180)

medium Nessus Plugin ID 12492
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated libpng packages that fix a out of bounds memory access are now available.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

Steve Grubb discovered a out of bounds memory access flaw in libpng.
An attacker could carefully craft a PNG file in such a way that it would cause an application linked to libpng to crash when opened by a victim. This issue may not be used to execute arbitrary code.

Users are advised to upgrade to these updated packages that contain a backported security fix not vulnerable to this issue.

Solution

Update the affected packages.

See Also

https://access.redhat.com/security/cve/cve-2004-0421

https://access.redhat.com/errata/RHSA-2004:180

Plugin Details

Severity: Medium

ID: 12492

File Name: redhat-RHSA-2004-180.nasl

Version: 1.28

Type: local

Agent: unix

Published: 7/6/2004

Updated: 1/14/2021

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:libpng, p-cpe:/a:redhat:enterprise_linux:libpng-devel, p-cpe:/a:redhat:enterprise_linux:libpng10, p-cpe:/a:redhat:enterprise_linux:libpng10-devel, cpe:/o:redhat:enterprise_linux:2.1, cpe:/o:redhat:enterprise_linux:3

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 5/19/2004

Vulnerability Publication Date: 8/18/2004

Reference Information

CVE: CVE-2004-0421

BID: 10244

RHSA: 2004:180