libpng: heap based buffer overflow
Posted Feb 17, 2006 2:17 UTC (Fri) by roelofs
Parent article: libpng: heap based buffer overflow
Note that is specifically a bug in libpng 1.2.7; it was detected and fixed in libpng 1.2.8 in 2004. It would be nice if the Red Hat advisories were a tad more precise about this sort of thing.
Even on Red Hat, it apparently doesn't affect very much. Here's an excerpt from their bug 179455:
Opened by Josh Bressers (Security Response Team) on 2006-01-31 10:42 EST
libpng heap based buffer overflow
There is a heap based buffer overflow in libpng 1.2.7 only. Upstream
has a note with the release for 1.2.8 that fixes a crash when a
program tries to strip alpha channels out of the image (calling the
png_set_strip_alpha() function during libpng initialization).
It should be noted that this particular libpng feature is only used by
tetex and xemacs within RHEL4, limiting the potential damage the
overflow can cause.
to post comments)