Input validation error in libpng - CVE-2013-7354

Vulnerability identifier: #VU33845

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2013-7354

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.

libpng
Gentoo Linux
openEuler
libpng (Alpine package)
libpng12
libpng12-debuginfo
libpng12-debugsource
libpng12-devel

Install update from vendor's website.

libpng - update to 1.5.14
libpng (Alpine package) - update to 1.5.14-r0
libpng12 - update to 1.2.57-12
libpng12-debuginfo - update to 1.2.57-12
libpng12-debugsource - update to 1.2.57-12
libpng12-devel - update to 1.2.57-12

• http://lists.opensuse.org/opensuse-updates/2014-05/msg00015.html
• http://seclists.org/oss-sec/2014/q2/83
• http://sourceforge.net/p/libpng/bugs/199/
• http://www.securityfocus.com/bid/67344

• Input validation error in libpng
• Input validation error in libpng (Alpine package)
• Gentoo update for libpng
• openEuler 20.03 LTS update for libpng12-1.2.57-11