Buffer overflow in libpng - CVE-2018-14048

Vulnerability identifier: #VU18304

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-14048

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing images within the png_free_data() function in png.c. A remote attacker can create a specially crafted image, pass it to the affected application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libpng
Gentoo Linux
Slackware Linux
Ubuntu
Isolation Segment
VMware Tanzu Application Service for VMs
Netcool Operations Insight
Tanzu Greenplum for Kubernetes
libpng (Alpine package)
libpng (Ubuntu package)
libpng12-0 (Ubuntu package)
libpng12-dev (Ubuntu package)
libpng3 (Ubuntu package)
VMware Tanzu Operations Manager

Install updates from vendor's website.

libpng - update to 1.6.35
Tanzu Greenplum for Kubernetes - update to 2.0.0
Netcool Operations Insight - update to 1.6.15
libpng (Alpine package) - update to 1.6.37-r0
libpng (Ubuntu package) - addressed in versions 1.2.50-1ubuntu2.14.04.3+esm2, 1.2.54-1ubuntu1.1+esm3, 1.6.20-2ubuntu0.1~esm4, 1.6.34-1ubuntu0.18.04.2+esm3, 1.6.37-2ubuntu0.1~esm3, 1.6.37-3ubuntu0.6
libpng12-0 (Ubuntu package) - update to 1.2.541ubuntu1.1+esm1
libpng12-dev (Ubuntu package) - update to 1.2.541ubuntu1.1+esm1
libpng3 (Ubuntu package) - update to 1.2.541ubuntu1.1+esm1
VMware Tanzu Operations Manager - addressed in versions 2.9.39, 2.10.40

• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• https://github.com/fouzhe/security/tree/master/libpng
• https://github.com/glennrp/libpng/issues/238

• Slackware Linux update for libpng
• Gentoo update for libpng
• Buffer overflow in libpng (Alpine package)
• Ubuntu update for libpng
• VMware Tanzu products update for libpng
• Multiple vulnerabilities in Netcool Operations Insight
• Ubuntu update for libpng