Integer underflow in libpng - CVE-2015-8540

Vulnerability identifier: #VU96992

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-8540

CWE-ID: CWE-191

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow within the png_check_keyword() function in pngwutil.c. A remote attacker can trick the victim to open a specially crafted PNG file, trigger an integer underflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libpng
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
Fedora
Slackware Linux
openEuler
libpng10
libpng
libpng12
libpng15-15
libpng15-debugsource
libpng15-15-debuginfo
media-libs/libpng
syslinux
syslinux-perl
syslinux-extlinux
syslinux-efi64
syslinux-devel
syslinux-debugsource
syslinux-debuginfo
syslinux-tftpboot
syslinux-nonlinux
syslinux-extlinux-nonlinux

Install updates from vendor's website.

libpng - addressed in versions 0.99, 1.0.66, 1.2.56, 1.4.19, 1.5.26
libpng10 - addressed in versions 1.0.66-1.el6, 1.0.66-1.fc22, 1.0.66-1.fc23
libpng - addressed in versions 1.2.56, 1.4.19
libpng12 - addressed in versions 1.2.56-1.fc22, 1.2.56-1.fc23
libpng15-15 - update to 1.5.30-10.13.1
libpng15-debugsource - update to 1.5.30-10.13.1
libpng15-15-debuginfo - update to 1.5.30-10.13.1
media-libs/libpng - update to 1.6.21
syslinux - update to 6.04-16
syslinux-perl - update to 6.04-16
syslinux-extlinux - update to 6.04-16
syslinux-efi64 - update to 6.04-16
syslinux-devel - update to 6.04-16
syslinux-debugsource - update to 6.04-16
syslinux-debuginfo - update to 6.04-16
syslinux-tftpboot - update to 6.04-16
syslinux-nonlinux - update to 6.04-16
syslinux-extlinux-nonlinux - update to 6.04-16

• http://sourceforge.net/projects/libpng/files/libpng10/1.0.66/
• http://www.openwall.com/lists/oss-security/2015/12/10/7
• http://www.openwall.com/lists/oss-security/2015/12/11/2
• http://sourceforge.net/projects/libpng/files/libpng12/1.2.56/
• http://sourceforge.net/p/libpng/bugs/244/
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174435.html
• http://sourceforge.net/projects/libpng/files/libpng15/1.5.26/
• http://sourceforge.net/projects/libpng/files/libpng14/1.4.19/
• http://www.securityfocus.com/bid/80592
• http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815b42ed/
• http://www.openwall.com/lists/oss-security/2015/12/10/6
• http://www.openwall.com/lists/oss-security/2015/12/17/10
• http://www.openwall.com/lists/oss-security/2015/12/11/1
• http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
• https://access.redhat.com/errata/RHSA-2016:1430
• https://security.gentoo.org/glsa/201611-08
• http://www.debian.org/security/2016/dsa-3443
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E

• Remote code execution in libpng
• openEuler update for syslinux
• Gentoo update for libpng
• Slackware Linux update for libpng
• Fedora 22 update for libpng10
• Fedora 23 update for libpng10
• Fedora EPEL 6 update for libpng10
• Fedora 23 update for libpng12
• Fedora 22 update for libpng12
• SUSE update for libpng15