OSVDB ID: 8313

Title: libpng png_handle_iCCP() Function NULL Pointer Dereference DoS

Info

Disclosure
Aug 04, 2004

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 A local overflow exists in libpng. The library function png_handle_iCCP fails to validate the input length from PNG files resulting in a possible NULL-pointer being referenced. With a specially crafted request, an attacker can cause denial of service which might result in a loss of availability for the application.

Classification

 Location: Local Access Required
Attack Type: Denial of Service, Input Manipulation
Impact: Loss of Availability
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

 Upgrade to version 1.2.6 release candidate 1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. Users of the older 1.0 series should upgrade to libpng-1.0.16 release candidate 1 or higher.

Products

PNG Development Group

libpng

 1.2.5
1.0.15

ImageMagick Studio LLC

ImageMagick

 6.0.0-2

GraphicsMagick Group

GraphicsMagick

 1.1.2

Microsoft Corporation

MSN Messenger

 6.1
6.2
5.0

References

Credit
  • Chris Evans - chrisscary.beasts.org -


Direct URL: http://osvdb.org/8313