CVE-2007-5268

2007-10-0800:00:00

ubuntu.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.015 Low

EPSS

Percentile

86.9%

JSON

pngrtran.c in libpng before 1.0.29 and 1.2.x before 1.2.21 use (1) logical
instead of bitwise operations and (2) incorrect comparisons, which might
allow remote attackers to cause a denial of service (crash) via a crafted
PNG image.

Notes

Author	Note
jdstrand	given medium because of wide install base bug (1) is said to have been introduced in 1.2.19. Looking at pngrtran.c in 1.2.8 and 1.2.15 (as included in Ubuntu), the vulnerable code is not present bug (2) still applies to 1.2.15, but not 1.2.8 reducing to negligible as pngset.c change should not do anything

OSVersionArchitecturePackageVersionFilename
ubuntu7.04noarchlibpng< 1.2.15~beta5-1ubuntu1.1UNKNOWN
ubuntu7.10noarchlibpng< 1.2.15~beta5-2ubuntu0.1UNKNOWN
ubuntu8.04noarchlibpng< 1.2.15~beta5-3ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	7.04	noarch	libpng	< 1.2.15~beta5-1ubuntu1.1	UNKNOWN
ubuntu	7.10	noarch	libpng	< 1.2.15~beta5-2ubuntu0.1	UNKNOWN
ubuntu	8.04	noarch	libpng	< 1.2.15~beta5-3ubuntu0.1	UNKNOWN