A local overflow exists in libpng. The library function png_handle_iCCP fails to validate the input length from PNG files resulting in a possible NULL-pointer being referenced. With a specially crafted request, an attacker can cause denial of service which might result in a loss of availability for the application.
Classification
Location:
Local Access Required
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Availability
Exploit:
Exploit Unknown
Solution
Upgrade to version 1.2.6 release candidate 1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. Users of the older 1.0 series should upgrade to libpng-1.0.16 release candidate 1 or higher.
scary.beasts.org -
