Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Libpng Library Updated to Patch Vulnerabilities

Libpng, the official Portable Network Graphics (PNG) reference library, has been updated to address a couple of memory corruption vulnerabilities.

Libpng, the official Portable Network Graphics (PNG) reference library, has been updated to address a couple of memory corruption vulnerabilities.

According to a security notice posted on the official libpng website, all versions through 1.6.18, 1.5.23, 1.4.16, 1.2.53 and 1.0.63 are affected by a potential out-of-bounds read in the png_set_tIME() and png_convert_to_rfc1123() functions (CVE-2015-7981), and an out-of-bounds write issue in the png_get_PLTE() and png_set_PLTE() functions (CVE-2015-8126).

“[The png_set_PLTE/png_get_PLTE] functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8,” explained libpng custodian Glenn Randers-Pehrson. “Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8.”

This high impact vulnerability (CVSS score of 7.5) can be exploited by a remote attacker to cause an application using libpng to enter a denial-of-service (DoS) condition via a specially crafted PNG file. NIST’s description of the vulnerability also notes that the flaw could possibly have other, unspecified impact.

The flaws were addressed last week with the release of versions 1.6.19, 1.5.24, 1.4.17, 1.2.54 and 1.0.64.

Developer James Babcock noted in a post on the Hacker News that certain software categories are at high risk, including web browsers, servers that accept and process PNG uploads, instant messaging clients and other apps that show user-provided avatar images, file browsers with image preview functionality, music players that display album covers, and even video games designed to download level data containing images. It’s also possible that the flaws can be exploited via MMS messages on Android.

One user noted that CVE-2015-8126 was initially discovered in the OptiPNG optimizer via the American Fuzzy Lop fuzzer developed by Google’s Michal Zalewski. It was later determined that the issue also impacts libpng.

It has been almost a year since the developers of libpng published a security warning on the official website. Nearly two dozen vulnerability warnings have been issued since 2004 and while most are for DoS flaws, some of them cover serious weaknesses that can be exploited for arbitrary code execution.

Advertisement. Scroll to continue reading.

It’s worth noting that libpng is one of the many open source projects covered by the Patch Reward Program launched by Google in October 2013.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join SecurityWeek and Hitachi Vantara for this this webinar to gain valuable insights and actionable steps to enhance your organization's data security and resilience.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Threat intelligence firm Intel 471 has appointed Mark Huebeler as its COO and CFO.

Omkhar Arasaratnam, former GM at OpenSSF, is LinkedIn's first Distinguised Security Engineer

Defense contractor Nightwing has appointed Tricia Fitzmaurice as Chief Growth Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.