[Bug 1291312] New: CVE-2015-8540 libpng: underflow read in png_check_keyword()

List overview All Threads
Download

newer

older

[Bug 851819] New: Review Request:...

[Bug 1291317] New: CVE-2015-8540...

Red Hat Bugzilla

14 Dec 2015 14 Dec '15

8:42 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Bug ID: 1291312 Summary: CVE-2015-8540 libpng: underflow read in png_check_keyword() Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: drizt@land.ru, erik-fedora@vanpienbroek.nl, fedora-mingw@lists.fedoraproject.org, ktietz@redhat.com, lfarkas@lfarkas.org, paul@city-fan.org, phracek@redhat.com, rdieter@math.unl.edu, rjones@redhat.com

An underflow read was found in png_check_keyword in pngwutil.c in libpng-1.2.54:

If the data of "key" is only ' ' (0x20), it will read a byte before the buffer in line 1288.

This issue impacts upstream versions 1.2.55, 1.0.65, 1.4.18, and 1.5.25 of libpng.

An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image.

CVE assignment:

http://seclists.org/oss-sec/2015/q4/469

Upstream issue:

http://sourceforge.net/p/libpng/bugs/244/

Upstream patch:

http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815b...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qQrX6Dct1p&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

14 Dec 14 Dec

8:43 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Martin Prpic mprpic@redhat.com changed:

--- Comment #1 from Martin Prpic mprpic@redhat.com ---

Created libpng tracking bugs for this issue:

Affects: fedora-all [bug 1291314]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1291314 [Bug 1291314] CVE-2015-8540 libpng: underflow read in png_check_keyword() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291315 [Bug 1291315] CVE-2015-8540 libpng12: libpng: underflow read in png_check_keyword() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291316 [Bug 1291316] CVE-2015-8540 libpng15: libpng: underflow read in png_check_keyword() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291317 [Bug 1291317] CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291318 [Bug 1291318] CVE-2015-8540 libpng10: libpng: underflow read in png_check_keyword() [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1291319 [Bug 1291319] CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1291320 [Bug 1291320] CVE-2015-8540 libpng10: libpng: underflow read in png_check_keyword() [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=HURumTyLwL&a=cc_unsubscribe

Red Hat Bugzilla

8:44 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #2 from Martin Prpic mprpic@redhat.com ---

Created libpng10 tracking bugs for this issue:

Affects: epel-6 [bug 1291318] Affects: fedora-all [bug 1291320]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=FCcupC2i39&a=cc_unsubscribe

Red Hat Bugzilla

8:44 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #3 from Martin Prpic mprpic@redhat.com ---

Created libpng12 tracking bugs for this issue:

Affects: fedora-all [bug 1291315]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1170yZDHHq&a=cc_unsubscribe

Red Hat Bugzilla

8:44 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #4 from Martin Prpic mprpic@redhat.com ---

Created libpng15 tracking bugs for this issue:

Affects: fedora-all [bug 1291316]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1dLdSmFYAt&a=cc_unsubscribe

Red Hat Bugzilla

8:44 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #5 from Martin Prpic mprpic@redhat.com ---

Created mingw-libpng tracking bugs for this issue:

Affects: fedora-all [bug 1291317] Affects: epel-7 [bug 1291319]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6FAAhT4Us0&a=cc_unsubscribe

Nerijus Baliunas

8:47 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

Is it possible to not spam the list with all the hundreds bugzilla security messages?

2015-12-14 16:44, bugzilla@redhat.com rašė:

...

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #5 from Martin Prpic mprpic@redhat.com ---

Created mingw-libpng tracking bugs for this issue:

Affects: fedora-all [bug 1291317] Affects: epel-7 [bug 1291319]

Nerijus Baliunas

8:57 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

Is it possible to not include the list in automatically created bugs:

This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora EPEL.

2015-12-14 16:47, Nerijus Baliūnas rašė:

...

Is it possible to not spam the list with all the hundreds bugzilla security messages?

2015-12-14 16:44, bugzilla@redhat.com rašė:

...
https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #5 from Martin Prpic mprpic@redhat.com ---

Created mingw-libpng tracking bugs for this issue:

Affects: fedora-all [bug 1291317] Affects: epel-7 [bug 1291319]

mingw mailing list mingw@lists.fedoraproject.org http://lists.fedoraproject.org/admin/lists/mingw@lists.fedoraproject.org

Red Hat Bugzilla

8:45 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Martin Prpic mprpic@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1291322

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1hOQ0Qs3an&a=cc_unsubscribe

Red Hat Bugzilla

21 Dec 21 Dec

8:37 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=OlQVcZUTG4&a=cc_unsubscribe

Red Hat Bugzilla

8:37 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5c5yB5YfsM&a=cc_unsubscribe

Red Hat Bugzilla

8:38 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Stefan Cornelius scorneli@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=SDe2TgFGAE&a=cc_unsubscribe

Red Hat Bugzilla

8:41 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #9 from Stefan Cornelius scorneli@redhat.com --- It seems like this is only an issue when an application uses a untrusted input when *writing* a PNG file. Only reading a PNG file should not be enough to trigger this. Since this is a library, it's hard to predict the exact criticality, as it depends on the application using it. For the most common scenarios, this should not be a major problem, it'll probably not even lead to a crash.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=usxXZZffDW&a=cc_unsubscribe

Red Hat Bugzilla

22 Dec 22 Dec

2:52 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=L5xPTVvwBt&a=cc_unsubscribe

Red Hat Bugzilla

26 Dec 26 Dec

7:50 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Yasuhiro Ozone yozone@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |yozone@redhat.com

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5zHrs7k8E8&a=cc_unsubscribe

Red Hat Bugzilla

28 Dec 28 Dec

4:56 p.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #10 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.66-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=aa46JfJFrc&a=cc_unsubscribe

Red Hat Bugzilla

4:56 p.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312 Bug 1291312 depends on bug 1291320, which changed state.

Bug 1291320 Summary: CVE-2015-8540 libpng10: libpng: underflow read in png_check_keyword() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291320

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=y7CZo4XCbp&a=cc_unsubscribe

Red Hat Bugzilla

30 Dec 30 Dec

7:50 p.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #11 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.66-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=1pnVN8aYuX&a=cc_unsubscribe

Red Hat Bugzilla

2 Jan 2 Jan

4:21 p.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #12 from Fedora Update System updates@fedoraproject.org --- libpng12-1.2.56-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AfqsDGg779&a=cc_unsubscribe

Red Hat Bugzilla

4:21 p.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312 Bug 1291312 depends on bug 1291315, which changed state.

Bug 1291315 Summary: CVE-2015-8540 libpng12: libpng: underflow read in png_check_keyword() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291315

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=XdYHvE6QiB&a=cc_unsubscribe

Red Hat Bugzilla

5:19 p.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #13 from Fedora Update System updates@fedoraproject.org --- libpng12-1.2.56-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=UqSLly7gyl&a=cc_unsubscribe

Red Hat Bugzilla

3 Jan 3 Jan

2:25 p.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #14 from Fedora Update System updates@fedoraproject.org --- libpng10-1.0.66-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=QMkW8aPGiP&a=cc_unsubscribe

Red Hat Bugzilla

2:25 p.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312 Bug 1291312 depends on bug 1291318, which changed state.

Bug 1291318 Summary: CVE-2015-8540 libpng10: libpng: underflow read in png_check_keyword() [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1291318

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=DMGZichB9D&a=cc_unsubscribe

Red Hat Bugzilla

20 Jan 20 Jan

8:58 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

29 Jan 29 Jan

6:07 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

2 Feb 2 Feb

4:05 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #15 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2016:0101 https://rhn.redhat.com/errata/RHSA-2016-0101.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

4:06 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #16 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2016:0100 https://rhn.redhat.com/errata/RHSA-2016-0100.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

7:53 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312

--- Comment #17 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Supplementary for Red Hat Enterprise Linux 7 Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2016:0099 https://rhn.redhat.com/errata/RHSA-2016-0099.html

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

6 Feb 6 Feb

10:55 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312 Bug 1291312 depends on bug 1291319, which changed state.

Bug 1291319 Summary: CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1291319

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

10:56 a.m.

New subject: [Bug 1291312] CVE-2015-8540 libpng: underflow read in png_check_keyword()

https://bugzilla.redhat.com/show_bug.cgi?id=1291312 Bug 1291312 depends on bug 1291317, which changed state.

Bug 1291317 Summary: CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1291317

-- You are receiving this mail because: You are on the CC list for the bug.

3167

Age (days ago)

3221

Last active (days ago)

mingw@lists.fedoraproject.org

29 comments

2 participants

tags (0)

participants (2)

Nerijus Baliunas
Red Hat Bugzilla