GLSA-200603-18 : Pngcrush: Buffer overflow
Medium Nessus Plugin ID 21125
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200603-18 (Pngcrush: Buffer overflow)
Carsten Lohrke of Gentoo Linux reported that Pngcrush contains a vulnerable version of zlib (GLSA 200507-19).
By creating a specially crafted data stream, attackers can overwrite data structures for applications that use Pngcrush, resulting in a Denial of Service and potentially arbitrary code execution.
There is no known workaround at this time.
SolutionAll Pngcrush users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=media-gfx/pngcrush-1.6.2'