Security Update for libpng
Summary
DSA-3443-1: libpng - security update. Affects libpng versions < 1.2.49-1+deb7u2. Fixed in 1.2.49-1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpng is a library used for reading and writing PNG (Portable Network Graphics) files. It provides a simple interface for developers to manipulate PNG images. However, several vulnerabilities have been discovered in the libpng library, which could potentially allow remote attackers to cause a denial of service or crash applications.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-8472, is a result of an incomplete fix for a previous vulnerability (CVE-2015-8126). This flaw allows applications using png_set_PLTE directly to be vulnerable to a potential overrun, leading to a denial of service.
The second vulnerability, known as CVE-2015-8540, is caused by a flaw in the png_check_keyword function. Exploiting this vulnerability could result in a denial of service by crashing the application.
How To Fix
Minimum fixed version
1.2.49-1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpngTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
Upgrading the libpng packages to the recommended versions will address the identified vulnerabilities. It is important to promptly apply these updates to ensure the security and stability of your applications. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libpng →
FAQ
libpng is a library used for reading and writing PNG (Portable Network Graphics) files. It provides a simple interface for developers to manipulate PNG images.
CVE-2015-8472 is a vulnerability in libpng that allows a remote attacker to cause a denial of service by exploiting an incomplete fix for a previous vulnerability (CVE-2015-8126).
CVE-2015-8540 is a vulnerability in libpng that can be exploited by a remote attacker to cause a denial of service by crashing the application.
To fix these vulnerabilities, you should upgrade the libpng packages to the recommended versions based on your distribution.
No, there are no mentioned workarounds for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for libpng.
