libpng 'png_set_unknown_chunks()' Function Heap Based Buffer Overflow Vulnerability
BID:67345
Info
libpng 'png_set_unknown_chunks()' Function Heap Based Buffer Overflow Vulnerability
| Bugtraq ID: | 67345 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2013-7353 |
| Remote: | Yes |
| Local: | No |
| Published: | May 12 2014 12:00AM |
| Updated: | Apr 13 2015 10:06PM |
| Credit: | Mageia |
| Vulnerable: |
Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 libpng libpng 1.5.6 beta libpng libpng 1.5.5 libpng libpng 1.5.4 libpng libpng 1.5 libpng libpng 1.5.9 Beta libpng libpng 1.5.9 libpng libpng 1.5.8 Beta libpng libpng 1.5.8 libpng libpng 1.5.7 Beta libpng libpng 1.5.7 libpng libpng 1.5.6 libpng libpng 1.5.5 Beta libpng libpng 1.5.4 Beta libpng libpng 1.5.3 Beta libpng libpng 1.5.2 Beta libpng libpng 1.5.2 libpng libpng 1.5.13 beta libpng libpng 1.5.13 libpng libpng 1.5.12 libpng libpng 1.5.11 beta libpng libpng 1.5.11 libpng libpng 1.5.10 Beta libpng libpng 1.5.10 libpng libpng 1.5.1 beta 01 libpng libpng 1.5.1 Beta libpng libpng 1.5.1 libpng libpng 1.5.0 Beta Gentoo Linux |
| Not Vulnerable: | |
Discussion
libpng 'png_set_unknown_chunks()' Function Heap Based Buffer Overflow Vulnerability
libpng is prone to a heap-based buffer-overflow vulnerability.
Successful exploits may allow attackers to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
libpng is prone to a heap-based buffer-overflow vulnerability.
Successful exploits may allow attackers to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.
Exploit / POC
libpng 'png_set_unknown_chunks()' Function Heap Based Buffer Overflow Vulnerability
Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
Solution / Fix
libpng 'png_set_unknown_chunks()' Function Heap Based Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Enterprise Server 5 x86_64
MandrakeSoft Enterprise Server 5
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Enterprise Server 5 x86_64
-
Mandriva lib64png-devel-1.2.31-2.9mdvmes5.2.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64png-static-devel-1.2.31-2.9mdvmes5.2.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64png3-1.2.31-2.9mdvmes5.2.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva libpng-source-1.2.31-2.9mdvmes5.2.x86_64.rpm
http://www.mandriva.com/en/downloads/
MandrakeSoft Enterprise Server 5
-
Mandriva libpng-devel-1.2.31-2.9mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva libpng-source-1.2.31-2.9mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva libpng-static-devel-1.2.31-2.9mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva libpng3-1.2.31-2.9mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/
Mandriva Business Server 1 X86 64
-
Mandriva lib64png-devel-1.5.10-2.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64png12-devel-1.2.49-2.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64png12_0-1.2.49-2.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva lib64png15_15-1.5.10-2.2.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/
References
libpng 'png_set_unknown_chunks()' Function Heap Based Buffer Overflow Vulnerability
References:
References:
- CVE-2013-7353 CVE-2013-7354 libpng integer overflows (oss-sec)
- libpng Homepage (libpng)
- Updated libpng packages fix security vulnerabilities: (mandriva)