ArchLinuxASA-201904-10[ASA-201904-10] libpng: denial of service
2.6 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:N/I:N/A:P
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
0.005 Low
EPSS
Percentile
75.4%
Arch Linux Security Advisory ASA-201904-10
Severity: Low
Date : 2019-04-24
CVE-ID : CVE-2019-7317
Package : libpng
Type : denial of service
Remote : No
Link : https://security.archlinux.org/AVG-868
Summary
The package libpng before version 1.6.37-1 is vulnerable to denial of
service.
Resolution
Upgrade to 1.6.37-1.
pacman -Syu “libpng>=1.6.37-1”
The problem has been fixed upstream in version 1.6.37.
Workaround
None.
Description
png_image_free in png.c in libpng 1.6.36 has a use-after-free because
png_image_free_function is called under png_safe_execute.
Impact
A remote attacker can crash an application using libpng via a crafted
image.
References
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803
https://github.com/glennrp/libpng/issues/275
https://security.archlinux.org/CVE-2019-7317
Related
2.6 Low
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:H/Au:N/C:N/I:N/A:P
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
0.005 Low
EPSS
Percentile
75.4%