Description
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.
References (9)
Core 9
Core References
Vendor Advisory vendor-advisory
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Third Party Advisory mailing-list
http://sourceforge.net/p/png-mng/mailman/message/33173461/
Exploit, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2015/01/10/1
Exploit mailing-list
http://www.openwall.com/lists/oss-security/2015/01/10/3
Permissions Required, Third Party Advisory third-party-advisory
http://secunia.com/advisories/62725
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
Vendor Advisory
https://support.apple.com/HT206167
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240719-0005/
Scores
CVSS v3
8.8
EPSS
0.0201
EPSS Percentile
83.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-119
CWE-120
Status
published
Products (19)
apple/mac_os_x
< 10.11.3
libpng/libpng
1.6.0 (2 CPE variants)
libpng/libpng
1.6.1 (2 CPE variants)
libpng/libpng
1.6.2 (2 CPE variants)
libpng/libpng
1.6.3 (2 CPE variants)
libpng/libpng
1.6.4 (2 CPE variants)
libpng/libpng
1.6.5
libpng/libpng
1.6.6
libpng/libpng
1.6.7 (2 CPE variants)
libpng/libpng
1.6.8 (2 CPE variants)
... and 9 more
Published
Jan 18, 2015
Tracked Since
Feb 18, 2026