CVE-2006-5793

Description

The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.

Affected products

• greg_roelofs / libpng1.0.6 – 1.0.6
• greg_roelofs / libpng1.0.7 – 1.0.7
• greg_roelofs / libpng1.0.8 – 1.0.8
• greg_roelofs / libpng1.0.9 – 1.0.9
• greg_roelofs / libpng1.2.0 – 1.2.0
• greg_roelofs / libpng1.2.1 – 1.2.1
• greg_roelofs / libpng1.2.2 – 1.2.2
• greg_roelofs / libpng1.2.3 – 1.2.3
• greg_roelofs / libpng1.2.4 – 1.2.4
• greg_roelofs / libpng1.2.5 – 1.2.5
• greg_roelofs / libpng1.2.6 – 1.2.6
• greg_roelofs / libpng1.2.7 – 1.2.7
• greg_roelofs / libpng1.2.7rc1 – 1.2.7rc1
• greg_roelofs / libpng1.2.8 – 1.2.8
• greg_roelofs / libpng1.2.9 – 1.2.9
• greg_roelofs / libpng1.2.10 – 1.2.10
• greg_roelofs / libpng1.2.11 – 1.2.11
• greg_roelofs / libpng1.2.12 – 1.2.12

References

• MISChttp://support.avaya.com/elmodocs2/security/ASA-2007-254.htm
• VENDOR_ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:209
• VENDOR_ADVISORYhttp://secunia.com/advisories/22941
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10324
• VENDOR_ADVISORYhttp://secunia.com/advisories/22956
• MISChttps://issues.rpath.com/browse/RPL-824
• VENDOR_ADVISORYhttp://secunia.com/advisories/22958
• MISChttp://www.coresecurity.com/?action=item&id=2148
• MISChttp://bugs.gentoo.org/show_bug.cgi?id=154380
• VENDOR_ADVISORYhttp://www.novell.com/linux/security/advisories/2006_28_sr.html
• VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2008/0924/references
• MISChttp://www.securityfocus.com/bid/21078
• VENDOR_ADVISORYhttp://secunia.com/advisories/22951
• MISChttps://issues.rpath.com/browse/RPL-790
• MISChttp://security.gentoo.org/glsa/glsa-200611-09.xml
• VENDOR_ADVISORYhttp://secunia.com/advisories/23335
• VENDOR_ADVISORYhttp://secunia.com/advisories/25329
• VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2006/4521
• VENDOR_ADVISORYhttp://secunia.com/advisories/29420
• MISChttp://securitytracker.com/id?1017244
• MISChttp://sourceforge.net/project/shownotes.php?release_id=464278
• MAILING_LISThttp://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
• MISChttp://www.securityfocus.com/archive/1/453484/100/100/threaded
• VENDOR_ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:210
• VENDOR_ADVISORYhttp://secunia.com/advisories/23208
• MISChttp://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html
• VENDOR_ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:212
• VENDOR_ADVISORYhttp://secunia.com/advisories/22889
• MISChttp://bugs.gentoo.org/attachment.cgi?id=101400&action=view
• MISChttp://www.securityfocus.com/archive/1/451874/100/200/threaded
• MISChttp://www.redhat.com/support/errata/RHSA-2007-0356.html
• VENDOR_ADVISORYhttp://www.openpkg.com/security/advisories/OpenPKG-SA-2006.036.html
• VENDOR_ADVISORYhttp://www.ubuntu.com/usn/usn-383-1
• VENDOR_ADVISORYhttp://docs.info.apple.com/article.html?artnum=307562
• VENDOR_ADVISORYhttp://secunia.com/advisories/22950
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/30290
• VENDOR_ADVISORYhttp://secunia.com/advisories/22900
• VENDOR_ADVISORYhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:211
• VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2006/4568
• MISChttp://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.465035
• VENDOR_ADVISORYhttp://secunia.com/advisories/25742
• MISChttp://www.trustix.org/errata/2006/0065/
• MISChttp://www.securityfocus.com/archive/1/489135/100/0/threaded