Lucene search

[email protected]NVD:CVE-2015-8126

HistoryNov 13, 2015 - 3:59 a.m.

CVE-2015-8126

2015-11-1303:59:05

CWE-120

[email protected]

web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

High

0.015 Low

EPSS

Percentile

86.9%

JSON

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Affected configurations

NVD

Node

libpnglibpngRange<1.0.64

libpnglibpngRange1.1.1–1.2.54

libpnglibpngRange1.3.0–1.4.17

libpnglibpngRange1.5.0–1.5.24

libpnglibpngRange1.6.0–1.6.19

Node

fedoraprojectfedoraMatch21

fedoraprojectfedoraMatch22

fedoraprojectfedoraMatch23

Node

opensuseleapMatch42.1

opensuseopensuseMatch13.1

opensuseopensuseMatch13.2

suselinux_enterprise_desktopMatch11sp3

suselinux_enterprise_desktopMatch11sp4

suselinux_enterprise_desktopMatch12-

suselinux_enterprise_desktopMatch12sp1

suselinux_enterprise_serverMatch12-

suselinux_enterprise_serverMatch12sp1

Node

debiandebian_linuxMatch7.0

debiandebian_linuxMatch8.0

debiandebian_linuxMatch9.0

Node

redhatsatelliteMatch5.7

redhatenterprise_linux_desktopMatch6.0

redhatenterprise_linux_desktopMatch7.0

redhatenterprise_linux_eusMatch6.7

redhatenterprise_linux_eusMatch7.2

redhatenterprise_linux_eusMatch7.3

redhatenterprise_linux_eusMatch7.4

redhatenterprise_linux_eusMatch7.5

redhatenterprise_linux_eusMatch7.6

redhatenterprise_linux_eusMatch7.7

redhatenterprise_linux_serverMatch6.0

redhatenterprise_linux_serverMatch7.0

redhatenterprise_linux_server_ausMatch7.2

redhatenterprise_linux_server_ausMatch7.3

redhatenterprise_linux_server_ausMatch7.4

redhatenterprise_linux_server_ausMatch7.6

redhatenterprise_linux_server_ausMatch7.7

redhatenterprise_linux_server_tusMatch7.2

redhatenterprise_linux_server_tusMatch7.3

redhatenterprise_linux_server_tusMatch7.6

redhatenterprise_linux_server_tusMatch7.7

redhatenterprise_linux_workstationMatch6.0

redhatenterprise_linux_workstationMatch7.0

Node

redhatsatelliteMatch5.6

AND

redhatenterprise_linuxMatch5.0

redhatenterprise_linuxMatch6.0

Node

oraclejdkMatch1.6.0update105

oraclejdkMatch1.7.0update91

oraclejdkMatch1.8.0update65

oraclejdkMatch1.8.0update66

oraclejreMatch1.6.0update105

oraclejreMatch1.7.0update91

oraclejreMatch1.8.0update65

oraclejreMatch1.8.0update66

oraclelinuxMatch6-

oraclelinuxMatch7-

oraclesolarisMatch11.3

Node

applemac_os_xRange<10.11.4

Node

canonicalubuntu_linuxMatch12.04esm

canonicalubuntu_linuxMatch14.04esm

canonicalubuntu_linuxMatch15.04

canonicalubuntu_linuxMatch15.10

References

googlechromereleases.blogspot.com/2016/03/stable-channel-update.html

lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

lists.fedoraproject.org/pipermail/package-announce/2015-November/172324.html

lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.html

lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.html

lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.html

lists.fedoraproject.org/pipermail/package-announce/2015-November/172769.html

lists.fedoraproject.org/pipermail/package-announce/2015-November/172797.html

lists.fedoraproject.org/pipermail/package-announce/2015-November/172823.html

lists.fedoraproject.org/pipermail/package-announce/2016-February/177344.html

lists.fedoraproject.org/pipermail/package-announce/2016-February/177382.html

lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.html

lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.html

lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.html

lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.html

lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.html

lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html

lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html

lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html

lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html

lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html

lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html

lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html

lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html

lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html

lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html

lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.html

lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.html

lists.opensuse.org/opensuse-updates/2015-11/msg00159.html

lists.opensuse.org/opensuse-updates/2015-11/msg00160.html

lists.opensuse.org/opensuse-updates/2015-12/msg00062.html

lists.opensuse.org/opensuse-updates/2015-12/msg00063.html

lists.opensuse.org/opensuse-updates/2016-01/msg00028.html

lists.opensuse.org/opensuse-updates/2016-01/msg00029.html

lists.opensuse.org/opensuse-updates/2016-01/msg00030.html

rhn.redhat.com/errata/RHSA-2015-2594.html

rhn.redhat.com/errata/RHSA-2015-2595.html

rhn.redhat.com/errata/RHSA-2015-2596.html

rhn.redhat.com/errata/RHSA-2016-0055.html

rhn.redhat.com/errata/RHSA-2016-0056.html

rhn.redhat.com/errata/RHSA-2016-0057.html

www.debian.org/security/2015/dsa-3399

www.debian.org/security/2016/dsa-3507

www.openwall.com/lists/oss-security/2015/11/12/2

www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

www.securityfocus.com/bid/77568

www.securitytracker.com/id/1034142

www.ubuntu.com/usn/USN-2815-1

access.redhat.com/errata/RHSA-2016:1430

code.google.com/p/chromium/issues/detail?id=560291

kc.mcafee.com/corporate/index?page=content&id=SB10148

security.gentoo.org/glsa/201603-09

security.gentoo.org/glsa/201611-08

support.apple.com/HT206167

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

High

0.015 Low

EPSS

Percentile

86.9%

JSON

Related for NVD:CVE-2015-8126