The updates released for the “libpng” library in late December patch an old vulnerability introduced by developers in 1995.
Libpng is the official Portable Network Graphics (PNG) reference library. The platform-independent library has been around for more than two decades and it has been used by various projects, including many Linux distributions.
Versions 1.6.26, 1.5.27, 1.4.19, 1.2.56, 1.0.66 and prior are affected by a null pointer dereference vulnerability related to the png_set_text_2() function. The security hole, tracked as CVE-2016-10087, only affects PNG image editors – viewing apps are not impacted – and it cannot be exploited without user interaction. Exploitation of the flaw can lead to a denial-of-service (DoS) condition.
“To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened,” developers of the Slackware Linux distro said in an advisory.
The vulnerability, discovered and patched by Patrick Keshishian, was introduced in June 1995, in version 0.71. The issue was resolved in late December with the release of libpng versions 1.6.27, 1.5.28, 1.4.20, 1.2.57 and 1.0.67.
In addition to Slackware, the developers of Red Hat, Debian, Gentoo, ArchLinux and SuSE have also published advisories for the flaw. However, the issue has been classified as a low-severity bug and only some Linux distributions have released patches.
Two dozen vulnerability warnings have been published on the official libpng website since 2004, including for DoS and code execution issues. However, CVE-2016-10087 was the only flaw identified and patched in 2016. In the previous year, libpng developers addressed three security holes, including a couple of memory corruption vulnerabilities.
Related Reading: Code Execution Flaws Patched in HDF5 Library
Related Reading: X.Org Library Flaws Allow Privilege Escalation, DoS Attacks
Related Reading: Several Vulnerabilities Patched in Libarchive Library
