User: Password:
Subscribe / Log in / New account

libpng: heap based buffer overflow

Package(s):libpng CVE #(s):CVE-2006-0481
Created:February 13, 2006 Updated:December 15, 2008
Description: A heap based buffer overflow bug was found in the way libpng strips alpha channels from a PNG image. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash or execute arbitrary code when the file is opened by a victim.
Gentoo 200812-15 povray 2008-12-14
Red Hat RHSA-2006:0205-01 libpng 2006-02-13

(Log in to post comments)

libpng: heap based buffer overflow

Posted Feb 17, 2006 2:17 UTC (Fri) by roelofs (guest, #2599) [Link]

Note that is specifically a bug in libpng 1.2.7; it was detected and fixed in libpng 1.2.8 in 2004. It would be nice if the Red Hat advisories were a tad more precise about this sort of thing.

Even on Red Hat, it apparently doesn't affect very much. Here's an excerpt from their bug 179455:

Opened by Josh Bressers (Security Response Team) on 2006-01-31 10:42 EST

libpng heap based buffer overflow

There is a heap based buffer overflow in libpng 1.2.7 only. Upstream
has a note with the release for 1.2.8 that fixes a crash when a
program tries to strip alpha channels out of the image (calling the
png_set_strip_alpha() function during libpng initialization).

It should be noted that this particular libpng feature is only used by
tetex and xemacs within RHEL4, limiting the potential damage the
overflow can cause.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds