Information disclosure in libpng - CVE-2015-7981

Vulnerability identifier: #VU82373

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-7981

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.

libpng
Gentoo Linux
Fedora
Slackware Linux
openEuler
IBM Integrated Management Module
Integrated Management Module II (IMM2)
libpng10
libpng
libpng12
media-libs/libpng
syslinux-debugsource
syslinux-devel
syslinux-efi64
syslinux-extlinux
syslinux-perl
syslinux-debuginfo
syslinux-tftpboot
syslinux-nonlinux
syslinux-extlinux-nonlinux
syslinux
GeForce driver for Linux

Install updates from vendor's website.

libpng - addressed in versions 1.0.64, 1.2.54, 1.4.17
IBM Integrated Management Module - update to YUOOH2B-1.5.1
Integrated Management Module II (IMM2) - update to 1aoo72h-5.60
libpng10 - addressed in versions 1.0.64-1.el6, 1.0.64-1.fc21, 1.0.64-1.fc22, 1.0.64-1.fc23
libpng - addressed in versions 1.2.54, 1.4.17
libpng12 - addressed in versions 1.2.56-1.fc22, 1.2.56-1.fc23
media-libs/libpng - update to 1.6.21
syslinux-debugsource - update to 6.04-16
syslinux-devel - update to 6.04-16
syslinux-efi64 - update to 6.04-16
syslinux-extlinux - update to 6.04-16
syslinux-perl - update to 6.04-16
syslinux-debuginfo - update to 6.04-16
syslinux-tftpboot - update to 6.04-16
syslinux-nonlinux - update to 6.04-16
syslinux-extlinux-nonlinux - update to 6.04-16
syslinux - update to 6.04-16
GeForce driver for Linux - update to 367.27

• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.html
• http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.html
• http://rhn.redhat.com/errata/RHSA-2015-2594.html
• http://rhn.redhat.com/errata/RHSA-2015-2595.html
• http://sourceforge.net/p/libpng/bugs/241/
• http://sourceforge.net/projects/libpng/files/libpng10/1.0.64/
• http://sourceforge.net/projects/libpng/files/libpng12/1.2.54/
• http://sourceforge.net/projects/libpng/files/libpng14/1.4.17/
• http://www.debian.org/security/2015/dsa-3399
• http://www.openwall.com/lists/oss-security/2015/10/26/1
• http://www.openwall.com/lists/oss-security/2015/10/26/3
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/77304
• http://www.securitytracker.com/id/1034393
• http://www.ubuntu.com/usn/USN-2815-1
• https://access.redhat.com/errata/RHSA-2016:1430
• https://security.gentoo.org/glsa/201611-08

• Multiple vulnerabilities in IBM Integrated Management Module (IMM)
• Multiple vulnerabilities in IBM Integrated Management Module II (IMM2) for System x, Flex and BladeCenter systems
• Multiple vulnerabilities in NVIDIA Linux device drivers for System x, Flex and BladeCenter Systems
• openEuler update for syslinux
• Gentoo update for libpng
• Slackware Linux update for libpng
• Fedora 21 update for libpng10
• Fedora 22 update for libpng10
• Fedora 23 update for libpng10
• Fedora EPEL 6 update for libpng10
• Fedora 23 update for libpng12
• Fedora 22 update for libpng12