Libpng Library Remote Denial of Service Vulnerability
TITLE: Libpng Library Remote Denial of Service Vulnerability
CLASS: Design Error
CVE: CVE-2007-2445
REMOTE: Yes
LOCAL: No
PUBLISHED: May 15 2007 12:00AM
UPDATE: Jun 12 2007 09:30AM
CREDIT: The vendor reported this issue.
VULNERABLE:
Ubuntu Ubuntu Linux 7.04 sparcNOT VULNERABLE:
Ubuntu Ubuntu Linux 7.04 powerpc
Ubuntu Ubuntu Linux 7.04 i386
Ubuntu Ubuntu Linux 7.04 amd64
Ubuntu Ubuntu Linux 6.10 sparc
Ubuntu Ubuntu Linux 6.10 powerpc
Ubuntu Ubuntu Linux 6.10 i386
Ubuntu Ubuntu Linux 6.10 amd64
Ubuntu Ubuntu Linux 6.06 LTS sparc
Ubuntu Ubuntu Linux 6.06 LTS powerpc
Ubuntu Ubuntu Linux 6.06 LTS i386
Ubuntu Ubuntu Linux 6.06 LTS amd64
SGI ProPack 3.0 SP6
rPath rPath Linux 1
RedHat Fedora Core6
RedHat Fedora Core5
RedHat Enterprise Linux Virtualization v.5 server
RedHat Enterprise Linux Supplementary v.5 server
RedHat Enterprise Linux Optional Productivity Application v.5 server
RedHat Enterprise Linux Hardware Certification v.5
RedHat Enterprise Linux Desktop Workstation v. 5 client
RedHat Enterprise Linux Desktop Supplementary v.5 client
RedHat Enterprise Linux Desktop Multi OS v.5 client
RedHat Enterprise Linux Desktop v.5 client
RedHat Enterprise Linux Clustering v.5 server
RedHat Enterprise Linux Cluster-Storage v.5 server
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux WS 3
RedHat Enterprise Linux WS 2.1 IA64
RedHat Enterprise Linux WS 2.1
RedHat Enterprise Linux v. 5 server
RedHat Enterprise Linux ES 4
RedHat Enterprise Linux ES 3
RedHat Enterprise Linux ES 2.1 IA64
RedHat Enterprise Linux ES 2.1
RedHat Enterprise Linux Desktop version 4
RedHat Enterprise Linux AS 4
RedHat Enterprise Linux AS 3
RedHat Enterprise Linux AS 2.1 IA64
RedHat Enterprise Linux AS 2.1
RedHat Desktop 4.0
RedHat Desktop 3.0
RedHat Advanced Workstation for the Itanium Processor 2.1 IA64
RedHat Advanced Workstation for the Itanium Processor 2.1
OpenPKG OpenPKG E1.0-Solid
OpenPKG OpenPKG Current
MandrakeSoft Multi Network Firewall 2.0
MandrakeSoft Linux Mandrake 2007.1 x86_64
MandrakeSoft Linux Mandrake 2007.1
MandrakeSoft Linux Mandrake 2007.0 x86_64
MandrakeSoft Linux Mandrake 2007.0
MandrakeSoft Corporate Server 4.0 x86_64
MandrakeSoft Corporate Server 3.0 x86_64
MandrakeSoft Corporate Server 3.0
MandrakeSoft Corporate Server 4.0
libpng libpng3 1.2.12
libpng libpng3 1.2.11
libpng libpng3 1.2.10
libpng libpng3 1.2.8
libpng libpng3 1.2.7
libpng libpng3 1.2.5
libpng libpng3 1.2.1
libpng libpng3 1.2 .0
libpng libpng 1.0.18
libpng libpng 1.0.17
libpng libpng 1.0.16
libpng libpng 1.0.15
libpng libpng 1.0.14
libpng libpng 1.0.13
libpng libpng 1.0.12
libpng libpng 1.0.11
libpng libpng 1.0.10
libpng libpng 1.0.9
libpng libpng 1.0.8
libpng libpng 1.0.7
libpng libpng 1.0.6
libpng libpng 1.0.5
libpng libpng 1.0
libpng libpng 0.90
Gentoo Linux
Foresight Linux Foresight Linux 1.1
libpng libpng 1.2.17
libpng libpng 1.0.25
Vai alla pagina originale su Security Focus
Discussion
The 'libpng' library is prone to a remote denial-of-service vulnerability because the library fails to handle malicious PNG files.
Successful exploits may allow remote attackers to cause denial-of-service conditions on computers running the affected library.
This issue affects 'libpng' 1.2.16 and prior versions.
Exploit
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:vuldb@securityfocus.com.
Solution
Solution:
The vendor has released an advisory to address this issue; please see the references for details.
RedHat Fedora Core6
- RedHat Fedora Core6 noarch/libpng-1.2.8-3.fc6.src.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/6/noarch/libpng-1.2.8-3.fc5.src.rpm - RedHat Fedora Core6 SRPMS/libpng-1.2.10-9.fc6.src.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/6/SRPMS/libpng-1.2.10-9.fc6.src.rpm
libpng libpng 0.90
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.10
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.11
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.12
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.13
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.14
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.15
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.16
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.17
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
libpng libpng 1.0.18
- libpng libpng-1.2.18.tar.gz
http://prdownloads.sourceforge.net/libpng/libpng-1.2.18.tar.gz
References
References:
- libpng Homepage (libpng)
- Libpng-1.2.16-ADVISORY.txt (PNG Development Group)
- Red Hat Security Advisory RHSA-2007-0356: libpng security update (Red Hat )
- Vulnerability Note VU#684664 (US-CERT)