[Bug 1086516] New: CVE-2013-7354 Integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

List overview All Threads
Download

newer

older

[Bug 890087] CVE-2012-5668...

[Bug 890094] CVE-2012-5670...

Red Hat Bugzilla

11 Apr 2014 11 Apr '14

6 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Bug ID: 1086516 Summary: CVE-2013-7354 Integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2() Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: huzaifas@redhat.com CC: drizt@land.ru, erik-fedora@vanpienbroek.nl, fedora-mingw@lists.fedoraproject.org, jkoncick@redhat.com, jkurik@redhat.com, ktietz@redhat.com, lfarkas@lfarkas.org, pfrields@redhat.com, phracek@redhat.com, rjones@redhat.com

An integer overflow leading to a heap-based buffer overflow was found in the png_set_sPLT() and png_set_text_2() API functions of libpng. A attacker could create a specially-crafated image file and render it with an application written to explicitly call png_set_sPLT() or png_set_text_2() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application.

The vendor mentions that internal calls use safe values. These issues could potentially affect applications that use the libpng API. Apparently no such applications were identified.

Reference:

http://sourceforge.net/p/libpng/bugs/199/ http://seclists.org/oss-sec/2014/q2/83

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=lqm7CkaJep&a=cc_unsubscribe

Show replies by date

Red Hat Bugzilla

11 Apr 11 Apr

6:01 a.m.

New subject: [Bug 1086516] CVE-2013-7354 Integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1086521

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=QporpmTOSG&a=cc_unsubscribe

Red Hat Bugzilla

8:33 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Tomas Hoger thoger@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=TMIVG1WwrG&a=cc_unsubscribe

Red Hat Bugzilla

11:42 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #1 from Huzaifa S. Sidhpurwala huzaifas@redhat.com --- This issue was addressed by the following upstream commits for libpng-1.6:

http://sourceforge.net/p/libpng/code/ci/590c8b0987f192ae588f6d952bfff5b398c4... http://sourceforge.net/p/libpng/code/ci/2414bd99d8c76f92ca9272f1b1b1eff55709...

This issue was addressed by the following upstream commits for libpng-1.5.14:

http://sourceforge.net/p/libpng/code/ci/798d3de5f66b6df6d6605f968da641c24725... http://sourceforge.net/p/libpng/code/ci/77a0a2ea113e699c7021caf1a530d2e2dd90...

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=V08SezEZCe&a=cc_unsubscribe

Red Hat Bugzilla

11:43 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=i4ZSIYv33Q&a=cc_unsubscribe

Red Hat Bugzilla

11:48 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1086669

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1086669 [Bug 1086669] CVE-2013-7353 libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks() [fedora-19]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=DRa3GOKIdN&a=cc_unsubscribe

Red Hat Bugzilla

11:48 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1086670

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1086670 [Bug 1086670] CVE-2013-7353 libpng15: libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks() [fedora-20]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=PVGTfMiUXo&a=cc_unsubscribe

Red Hat Bugzilla

11:49 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1086671

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1086671 [Bug 1086671] CVE-2013-7353 mingw-libpng: libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks() [fedora-19]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=XclHmllnGU&a=cc_unsubscribe

Red Hat Bugzilla

11:49 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1086672

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1086672 [Bug 1086672] CVE-2013-7353 mingw32-libpng: libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks() [epel-5]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=biq0MVuK57&a=cc_unsubscribe

Red Hat Bugzilla

11:50 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1086673

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1086673 [Bug 1086673] CVE-2013-7353 libpng10: libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks() [epel-6]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=V2Ukvh9l7a&a=cc_unsubscribe

Red Hat Bugzilla

11:51 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1086674

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1086674 [Bug 1086674] CVE-2013-7353 mingw32-libpng: libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks() [epel-6]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Z2YtsUrVcU&a=cc_unsubscribe

Red Hat Bugzilla

11:51 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #2 from Huzaifa S. Sidhpurwala huzaifas@redhat.com ---

Created libpng tracking bugs for this issue:

Affects: fedora-19 [bug 1086669]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bE0CtmXZtn&a=cc_unsubscribe

Red Hat Bugzilla

11:51 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #3 from Huzaifa S. Sidhpurwala huzaifas@redhat.com ---

Created libpng10 tracking bugs for this issue:

Affects: epel-6 [bug 1086673]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=nCQBE3UOEX&a=cc_unsubscribe

Red Hat Bugzilla

11:51 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #4 from Huzaifa S. Sidhpurwala huzaifas@redhat.com ---

Created libpng15 tracking bugs for this issue:

Affects: fedora-20 [bug 1086670]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=LxQnID0ky9&a=cc_unsubscribe

Red Hat Bugzilla

11:51 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #5 from Huzaifa S. Sidhpurwala huzaifas@redhat.com ---

Created mingw-libpng tracking bugs for this issue:

Affects: fedora-19 [bug 1086671]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=yPTJzsEdrW&a=cc_unsubscribe

Red Hat Bugzilla

11:51 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #6 from Huzaifa S. Sidhpurwala huzaifas@redhat.com ---

Created mingw32-libpng tracking bugs for this issue:

Affects: epel-5 [bug 1086672] Affects: epel-6 [bug 1086674]

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=zW3OYcLEaC&a=cc_unsubscribe

Red Hat Bugzilla

5:06 p.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #7 from Paul Howarth paul@city-fan.org --- Upstream says libpng10, 12, and 14 were not affected.

http://sourceforge.net/p/png-mng/mailman/message/32215052/

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=XnfYXeNpPA&a=cc_unsubscribe

Red Hat Bugzilla

5:07 p.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516 Bug 1086516 depends on bug 1086673, which changed state.

Bug 1086673 Summary: CVE-2013-7353 CVE-2013-7354 libpng10: various flaws [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1086673

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=sACdX67EFJ&a=cc_unsubscribe

Red Hat Bugzilla

21 Apr 21 Apr

9:48 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516 Bug 1086516 depends on bug 1086672, which changed state.

Bug 1086672 Summary: CVE-2013-7353 CVE-2013-7354 mingw32-libpng: various flaws [epel-5] https://bugzilla.redhat.com/show_bug.cgi?id=1086672

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=RRDBZs0fA1&a=cc_unsubscribe

Red Hat Bugzilla

9:48 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516 Bug 1086516 depends on bug 1086674, which changed state.

Bug 1086674 Summary: CVE-2013-7353 CVE-2013-7354 mingw32-libpng: various flaws [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1086674

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=xgYMQ25EDU&a=cc_unsubscribe

Red Hat Bugzilla

9:49 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=TQd24frxQn&a=cc_unsubscribe

Red Hat Bugzilla

9:54 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #8 from Huzaifa S. Sidhpurwala huzaifas@redhat.com --- Statement:

Not vulnerable. This issue does not affect the version of libpng as shipped with Red Hat Enterprise Linux 5 and 6.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=TsKFQYFdO8&a=cc_unsubscribe

Red Hat Bugzilla

9:59 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=PptMmjwe9n&a=cc_unsubscribe

Red Hat Bugzilla

11:04 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ViBsJzba99&a=cc_unsubscribe

Red Hat Bugzilla

21 May 21 May

9:26 p.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #9 from Petr Hracek phracek@redhat.com --- Does this affect also libpng in Fedora 20 where is version 1.6.6?

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=CzV5dg9ey7&a=cc_unsubscribe

Red Hat Bugzilla

10 Jun 10 Jun

5:13 a.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516 Bug 1086516 depends on bug 1086671, which changed state.

Bug 1086671 Summary: CVE-2013-7353 CVE-2013-7354 mingw-libpng: various flaws [fedora-19] https://bugzilla.redhat.com/show_bug.cgi?id=1086671

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VHW19ox0e2&a=cc_unsubscribe

Red Hat Bugzilla

21 Jan 21 Jan

12:13 p.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516 Bug 1086516 depends on bug 1086670, which changed state.

Bug 1086670 Summary: CVE-2013-7353 CVE-2013-7354 libpng15: various flaws [fedora-20] https://bugzilla.redhat.com/show_bug.cgi?id=1086670

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Vkh3aO88Pg&a=cc_unsubscribe

Red Hat Bugzilla

12:17 p.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516 Bug 1086516 depends on bug 1086669, which changed state.

Bug 1086669 Summary: CVE-2013-7353 CVE-2013-7354 libpng: various flaws [fedora-19] https://bugzilla.redhat.com/show_bug.cgi?id=1086669

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ckJtotMcRb&a=cc_unsubscribe

Red Hat Bugzilla

12:26 p.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

--- Comment #10 from Petr Hracek phracek@redhat.com --- This is already fixed in libpng-1.6.6 version.

I have checked that against upstream.

-- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=RG2X69oBEE&a=cc_unsubscribe

Red Hat Bugzilla

4 Mar 4 Mar

1:35 p.m.

New subject: [Bug 1086516] CVE-2013-7354 libpng: integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()

https://bugzilla.redhat.com/show_bug.cgi?id=1086516

Ján Rusnačko jrusnack@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

3121

Age (days ago)

3814

Last active (days ago)

mingw@lists.fedoraproject.org

29 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla