libpng: heap based buffer overflow [LWN.net]

libpng: heap based buffer overflow

Posted Feb 17, 2006 2:17 UTC (Fri) by roelofs (guest, #2599)
Parent article: libpng: heap based buffer overflow

Note that is specifically a bug in libpng 1.2.7; it was detected and fixed in libpng 1.2.8 in 2004. It would be nice if the Red Hat advisories were a tad more precise about this sort of thing.

Even on Red Hat, it apparently doesn't affect very much. Here's an excerpt from their bug 179455:

Opened by Josh Bressers (Security Response Team) on 2006-01-31 10:42 EST

libpng heap based buffer overflow

There is a heap based buffer overflow in libpng 1.2.7 only. Upstream
has a note with the release for 1.2.8 that fixes a crash when a
program tries to strip alpha channels out of the image (calling the
png_set_strip_alpha() function during libpng initialization).

It should be noted that this particular libpng feature is only used by
tetex and xemacs within RHEL4, limiting the potential damage the
overflow can cause.

Greg

(Log in to post comments)