Critical SEGV Vulnerability in libpng: Impacting Multiple Alpine Versions
Summary
ALPINE-CVE-2018-14048: An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image. Affects libpng versions < 1.6.37-r0. Fixed in 1.6.37-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libpng is a widely used library for handling PNG (Portable Network Graphics) image files. It provides essential functionalities for reading and writing PNG images, making it a critical component in various applications and systems. The library is known for its performance and flexibility, but it has been found to have vulnerabilities that can lead to severe security issues, particularly in error handling scenarios.
Vulnerability Detail
An issue has been identified in libpng version 1.6.34, which leads to a segmentation fault (SEGV) in the function png_free_data within png.c. This vulnerability arises from improper error handling during the png_read_image process. If exploited, it can result in application crashes and potential denial of service, affecting the stability and security of applications relying on this library. The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.6.37-r0
This is the first release that contains the fix.
sudo apk add --upgrade libpngTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if upgrading is not immediately feasible, you can limit the usage of libpng functions that involve reading PNG images until the package is updated. This can help mitigate the risk of exploitation.
Conclusion
The identified SEGV vulnerability in libpng poses a significant risk to applications using this library across multiple Alpine versions. It is crucial to update to the patched version to ensure system stability and security. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libpng →
FAQ
The vulnerability is a segmentation fault (SEGV) that occurs due to improper error handling in the png_read_image function.
All Alpine versions from v3.6 to v3.22 that include libpng prior to version 1.6.37-r0 are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes and denial of service, impacting the stability of systems using libpng.
Yes, the permanent fix is to update libpng to version 1.6.37-r0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for libpng.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
