CVE-2015-8540
Summary
| CVE | CVE-2015-8540 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-04-14 14:59:03 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read. |
Risk And Classification
Primary CVSS: v3.0 8.8 HIGH from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Problem Types: CWE-189 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 8.8 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:M/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 6.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 23 | All | All | All |
| Application | Libpng | Libpng | 0.90 | All | All | All |
| Application | Libpng | Libpng | 0.95 | All | All | All |
| Application | Libpng | Libpng | 0.96 | All | All | All |
| Application | Libpng | Libpng | 0.97 | All | All | All |
| Application | Libpng | Libpng | 0.98 | All | All | All |
| Application | Libpng | Libpng | 0.99 | All | All | All |
| Application | Libpng | Libpng | 1.0.0 | All | All | All |
| Application | Libpng | Libpng | 1.0.1 | All | All | All |
| Application | Libpng | Libpng | 1.0.10 | All | All | All |
| Application | Libpng | Libpng | 1.0.11 | All | All | All |
| Application | Libpng | Libpng | 1.0.12 | All | All | All |
| Application | Libpng | Libpng | 1.0.13 | All | All | All |
| Application | Libpng | Libpng | 1.0.14 | All | All | All |
| Application | Libpng | Libpng | 1.0.15 | All | All | All |
| Application | Libpng | Libpng | 1.0.16 | All | All | All |
| Application | Libpng | Libpng | 1.0.17 | All | All | All |
| Application | Libpng | Libpng | 1.0.18 | All | All | All |
| Application | Libpng | Libpng | 1.0.19 | All | All | All |
| Application | Libpng | Libpng | 1.0.2 | All | All | All |
| Application | Libpng | Libpng | 1.0.20 | All | All | All |
| Application | Libpng | Libpng | 1.0.21 | All | All | All |
| Application | Libpng | Libpng | 1.0.22 | All | All | All |
| Application | Libpng | Libpng | 1.0.23 | All | All | All |
| Application | Libpng | Libpng | 1.0.24 | All | All | All |
| Application | Libpng | Libpng | 1.0.25 | All | All | All |
| Application | Libpng | Libpng | 1.0.26 | All | All | All |
| Application | Libpng | Libpng | 1.0.27 | All | All | All |
| Application | Libpng | Libpng | 1.0.28 | All | All | All |
| Application | Libpng | Libpng | 1.0.29 | All | All | All |
| Application | Libpng | Libpng | 1.0.3 | All | All | All |
| Application | Libpng | Libpng | 1.0.30 | All | All | All |
| Application | Libpng | Libpng | 1.0.31 | All | All | All |
| Application | Libpng | Libpng | 1.0.32 | All | All | All |
| Application | Libpng | Libpng | 1.0.33 | All | All | All |
| Application | Libpng | Libpng | 1.0.34 | All | All | All |
| Application | Libpng | Libpng | 1.0.35 | All | All | All |
| Application | Libpng | Libpng | 1.0.37 | All | All | All |
| Application | Libpng | Libpng | 1.0.38 | All | All | All |
| Application | Libpng | Libpng | 1.0.39 | All | All | All |
| Application | Libpng | Libpng | 1.0.40 | All | All | All |
| Application | Libpng | Libpng | 1.0.41 | All | All | All |
| Application | Libpng | Libpng | 1.0.42 | All | All | All |
| Application | Libpng | Libpng | 1.0.43 | All | All | All |
| Application | Libpng | Libpng | 1.0.44 | All | All | All |
| Application | Libpng | Libpng | 1.0.45 | All | All | All |
| Application | Libpng | Libpng | 1.0.46 | All | All | All |
| Application | Libpng | Libpng | 1.0.47 | All | All | All |
| Application | Libpng | Libpng | 1.0.48 | All | All | All |
| Application | Libpng | Libpng | 1.0.5 | All | All | All |
| Application | Libpng | Libpng | 1.0.50 | All | All | All |
| Application | Libpng | Libpng | 1.0.51 | All | All | All |
| Application | Libpng | Libpng | 1.0.52 | All | All | All |
| Application | Libpng | Libpng | 1.0.53 | All | All | All |
| Application | Libpng | Libpng | 1.0.54 | All | All | All |
| Application | Libpng | Libpng | 1.0.55 | All | All | All |
| Application | Libpng | Libpng | 1.0.55 | rc01 | All | All |
| Application | Libpng | Libpng | 1.0.56 | All | All | All |
| Application | Libpng | Libpng | 1.0.56 | devel | All | All |
| Application | Libpng | Libpng | 1.0.57 | All | All | All |
| Application | Libpng | Libpng | 1.0.57 | rc01 | All | All |
| Application | Libpng | Libpng | 1.0.58 | All | All | All |
| Application | Libpng | Libpng | 1.0.59 | All | All | All |
| Application | Libpng | Libpng | 1.0.6 | All | All | All |
| Application | Libpng | Libpng | 1.0.60 | All | All | All |
| Application | Libpng | Libpng | 1.0.61 | All | All | All |
| Application | Libpng | Libpng | 1.0.62 | All | All | All |
| Application | Libpng | Libpng | 1.0.63 | All | All | All |
| Application | Libpng | Libpng | 1.0.64 | All | All | All |
| Application | Libpng | Libpng | 1.0.65 | All | All | All |
| Application | Libpng | Libpng | 1.0.7 | All | All | All |
| Application | Libpng | Libpng | 1.0.8 | All | All | All |
| Application | Libpng | Libpng | 1.0.9 | All | All | All |
| Application | Libpng | Libpng | 1.1.1 | All | All | All |
| Application | Libpng | Libpng | 1.2.0 | All | All | All |
| Application | Libpng | Libpng | 1.2.1 | All | All | All |
| Application | Libpng | Libpng | 1.2.10 | All | All | All |
| Application | Libpng | Libpng | 1.2.11 | All | All | All |
| Application | Libpng | Libpng | 1.2.12 | All | All | All |
| Application | Libpng | Libpng | 1.2.13 | All | All | All |
| Application | Libpng | Libpng | 1.2.14 | All | All | All |
| Application | Libpng | Libpng | 1.2.15 | All | All | All |
| Application | Libpng | Libpng | 1.2.16 | All | All | All |
| Application | Libpng | Libpng | 1.2.17 | All | All | All |
| Application | Libpng | Libpng | 1.2.18 | All | All | All |
| Application | Libpng | Libpng | 1.2.19 | All | All | All |
| Application | Libpng | Libpng | 1.2.2 | All | All | All |
| Application | Libpng | Libpng | 1.2.20 | All | All | All |
| Application | Libpng | Libpng | 1.2.21 | All | All | All |
| Application | Libpng | Libpng | 1.2.22 | All | All | All |
| Application | Libpng | Libpng | 1.2.23 | All | All | All |
| Application | Libpng | Libpng | 1.2.24 | All | All | All |
| Application | Libpng | Libpng | 1.2.25 | All | All | All |
| Application | Libpng | Libpng | 1.2.26 | All | All | All |
| Application | Libpng | Libpng | 1.2.27 | All | All | All |
| Application | Libpng | Libpng | 1.2.28 | All | All | All |
| Application | Libpng | Libpng | 1.2.29 | All | All | All |
| Application | Libpng | Libpng | 1.2.3 | All | All | All |
| Application | Libpng | Libpng | 1.2.30 | All | All | All |
| Application | Libpng | Libpng | 1.2.31 | All | All | All |
| Application | Libpng | Libpng | 1.2.32 | All | All | All |
| Application | Libpng | Libpng | 1.2.33 | All | All | All |
| Application | Libpng | Libpng | 1.2.34 | All | All | All |
| Application | Libpng | Libpng | 1.2.35 | All | All | All |
| Application | Libpng | Libpng | 1.2.36 | All | All | All |
| Application | Libpng | Libpng | 1.2.37 | All | All | All |
| Application | Libpng | Libpng | 1.2.38 | All | All | All |
| Application | Libpng | Libpng | 1.2.39 | All | All | All |
| Application | Libpng | Libpng | 1.2.4 | All | All | All |
| Application | Libpng | Libpng | 1.2.40 | All | All | All |
| Application | Libpng | Libpng | 1.2.41 | All | All | All |
| Application | Libpng | Libpng | 1.2.42 | All | All | All |
| Application | Libpng | Libpng | 1.2.43 | All | All | All |
| Application | Libpng | Libpng | 1.2.43 | devel | All | All |
| Application | Libpng | Libpng | 1.2.44 | All | All | All |
| Application | Libpng | Libpng | 1.2.45 | All | All | All |
| Application | Libpng | Libpng | 1.2.45 | devel | All | All |
| Application | Libpng | Libpng | 1.2.46 | All | All | All |
| Application | Libpng | Libpng | 1.2.46 | devel | All | All |
| Application | Libpng | Libpng | 1.2.47 | All | All | All |
| Application | Libpng | Libpng | 1.2.47 | beta | All | All |
| Application | Libpng | Libpng | 1.2.48 | All | All | All |
| Application | Libpng | Libpng | 1.2.48 | betas | All | All |
| Application | Libpng | Libpng | 1.2.49 | All | All | All |
| Application | Libpng | Libpng | 1.2.5 | All | All | All |
| Application | Libpng | Libpng | 1.2.50 | All | All | All |
| Application | Libpng | Libpng | 1.2.51 | All | All | All |
| Application | Libpng | Libpng | 1.2.52 | All | All | All |
| Application | Libpng | Libpng | 1.2.53 | All | All | All |
| Application | Libpng | Libpng | 1.2.54 | All | All | All |
| Application | Libpng | Libpng | 1.2.55 | All | All | All |
| Application | Libpng | Libpng | 1.2.6 | All | All | All |
| Application | Libpng | Libpng | 1.2.7 | All | All | All |
| Application | Libpng | Libpng | 1.2.8 | All | All | All |
| Application | Libpng | Libpng | 1.2.9 | All | All | All |
| Application | Libpng | Libpng | 1.3.0 | All | All | All |
| Application | Libpng | Libpng | 1.4.0 | All | All | All |
| Application | Libpng | Libpng | 1.4.1 | All | All | All |
| Application | Libpng | Libpng | 1.4.10 | All | All | All |
| Application | Libpng | Libpng | 1.4.11 | All | All | All |
| Application | Libpng | Libpng | 1.4.12 | All | All | All |
| Application | Libpng | Libpng | 1.4.13 | All | All | All |
| Application | Libpng | Libpng | 1.4.14 | All | All | All |
| Application | Libpng | Libpng | 1.4.15 | All | All | All |
| Application | Libpng | Libpng | 1.4.16 | All | All | All |
| Application | Libpng | Libpng | 1.4.17 | All | All | All |
| Application | Libpng | Libpng | 1.4.18 | All | All | All |
| Application | Libpng | Libpng | 1.4.2 | All | All | All |
| Application | Libpng | Libpng | 1.4.3 | All | All | All |
| Application | Libpng | Libpng | 1.4.4 | All | All | All |
| Application | Libpng | Libpng | 1.4.5 | All | All | All |
| Application | Libpng | Libpng | 1.4.6 | All | All | All |
| Application | Libpng | Libpng | 1.4.7 | All | All | All |
| Application | Libpng | Libpng | 1.4.8 | All | All | All |
| Application | Libpng | Libpng | 1.4.9 | All | All | All |
| Application | Libpng | Libpng | 1.5.0 | beta | All | All |
| Application | Libpng | Libpng | 1.5.1 | All | All | All |
| Application | Libpng | Libpng | 1.5.1 | beta | All | All |
| Application | Libpng | Libpng | 1.5.10 | beta | All | All |
| Application | Libpng | Libpng | 1.5.11 | All | All | All |
| Application | Libpng | Libpng | 1.5.11 | beta | All | All |
| Application | Libpng | Libpng | 1.5.12 | All | All | All |
| Application | Libpng | Libpng | 1.5.13 | All | All | All |
| Application | Libpng | Libpng | 1.5.13 | beta | All | All |
| Application | Libpng | Libpng | 1.5.14 | All | All | All |
| Application | Libpng | Libpng | 1.5.15 | All | All | All |
| Application | Libpng | Libpng | 1.5.16 | All | All | All |
| Application | Libpng | Libpng | 1.5.17 | All | All | All |
| Application | Libpng | Libpng | 1.5.18 | All | All | All |
| Application | Libpng | Libpng | 1.5.19 | All | All | All |
| Application | Libpng | Libpng | 1.5.2 | All | All | All |
| Application | Libpng | Libpng | 1.5.2 | beta | All | All |
| Application | Libpng | Libpng | 1.5.20 | beta | All | All |
| Application | Libpng | Libpng | 1.5.21 | All | All | All |
| Application | Libpng | Libpng | 1.5.22 | All | All | All |
| Application | Libpng | Libpng | 1.5.23 | All | All | All |
| Application | Libpng | Libpng | 1.5.24 | All | All | All |
| Application | Libpng | Libpng | 1.5.25 | All | All | All |
| Application | Libpng | Libpng | 1.5.3 | beta | All | All |
| Application | Libpng | Libpng | 1.5.4 | All | All | All |
| Application | Libpng | Libpng | 1.5.4 | beta | All | All |
| Application | Libpng | Libpng | 1.5.5 | All | All | All |
| Application | Libpng | Libpng | 1.5.5 | beta | All | All |
| Application | Libpng | Libpng | 1.5.6 | All | All | All |
| Application | Libpng | Libpng | 1.5.6 | beta | All | All |
| Application | Libpng | Libpng | 1.5.7 | All | All | All |
| Application | Libpng | Libpng | 1.5.7 | beta | All | All |
| Application | Libpng | Libpng | 1.5.8 | All | All | All |
| Application | Libpng | Libpng | 1.5.8 | beta | All | All |
| Application | Libpng | Libpng | 1.5.9 | All | All | All |
| Application | Libpng | Libpng | 1.5.9 | beta | All | All |
| Operating System | Redhat | Enterprise Linux Desktop Supplementary | 5.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop Supplementary | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Hpc Node | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Supplementary | 5.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server Supplementary | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation Supplementary | 6.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| LIBPNG: PNG reference library - Browse Files at SourceForge.net | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | Patch |
| LIBPNG: PNG reference library / Bugs / #244 read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | |
| oss-security - CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Debian -- Security Information -- DSA-3443-1 libpng | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| oss-security - Re: CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e69... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| libpng 'pngwutil.c' Underflow Read Remote Code Execution Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [SECURITY] Fedora 23 Update: libpng10-1.0.66-1.fc23 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| LIBPNG: PNG reference library / Code / Commit [d9006f] | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | |
| PNG reference library: libpng - Browse /libpng12/1.2.56 at SourceForge.net | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | Patch |
| Oracle Solaris Bulletin - July 2016 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | |
| PNG reference library: libpng - Browse /libpng10/1.0.66 at SourceForge.net | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | Patch |
| lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450... | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | |
| oss-security - Re: Re: CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| PNG reference library: libpng - Browse /libpng15/1.5.26 at SourceForge.net | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | Patch |
| oss-security - Re: CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| oss-security - Re: CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| libpng: Multiple vulnerabilities (GLSA 201611-08) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| Pony Mail! | MITRE | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 354662 Amazon Linux Security Advisory for libpng : ALAS2-2023-1904