libpng contains an overflow condition in the handling of PNG files. The issue is due to the 'png_handle_sBIT()' function not sanitizing user-supplied input. With a specially crafted PNG file, a context-dependent attacker can cause a buffer overflow to cause a denial of service or potentially execute arbitrary code.
Classification
Location:
Context Dependent
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Unknown
Disclosure:
Vendor Verified
Solution
Upgrade to version 1.2.6, or 1.0.16 or higher, as it has been reported to fix this vulnerability. In addition, the vendor has released a patch for some older versions.
