libpng: heap based buffer overflow [LWN.net]

Package(s):

libpng

CVE #(s):

CVE-2006-0481

Created:

February 13, 2006

Updated:

December 15, 2008

Description:

A heap based buffer overflow bug was found in the way libpng strips alpha channels from a PNG image. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash or execute arbitrary code when the file is opened by a victim.

Alerts:

Gentoo	200812-15	2008-12-14
Red Hat	RHSA-2006:0205-01	2006-02-13

(Log in to post comments)

libpng: heap based buffer overflow

Posted Feb 17, 2006 2:17 UTC (Fri) by roelofs (guest, #2599) [Link]

Note that is specifically a bug in libpng 1.2.7; it was detected and fixed in libpng 1.2.8 in 2004. It would be nice if the Red Hat advisories were a tad more precise about this sort of thing.

Even on Red Hat, it apparently doesn't affect very much. Here's an excerpt from their bug 179455:

Opened by Josh Bressers (Security Response Team) on 2006-01-31 10:42 EST

libpng heap based buffer overflow

There is a heap based buffer overflow in libpng 1.2.7 only. Upstream
has a note with the release for 1.2.8 that fixes a crash when a
program tries to strip alpha channels out of the image (calling the
png_set_strip_alpha() function during libpng initialization).

It should be noted that this particular libpng feature is only used by
tetex and xemacs within RHEL4, limiting the potential damage the
overflow can cause.

Greg