CVE-2015-8472

HIGH

libpng <1.0.65, 1.1.x, 1.2.x <1.2.55, 1.3.x, 1.4.x <1.4.18, 1.5.x <...

Title source: llm
STIX 2.1

Description

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.

References (31)

Core 31
Core References
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Vendor Advisory x_refsource_confirm
https://support.apple.com/HT206167
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2016:1430
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2595.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2596.html
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/12/03/6
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/78624
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0057.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0055.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3443
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0056.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2594.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.html

Scores

CVSS v3 7.3
EPSS 0.0605
EPSS Percentile 92.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Details

CWE
CWE-119
Status published
Products (50)
apple/mac_os_x < 10.11.3
libpng/libpng 1.0.64
libpng/libpng 1.2.0
libpng/libpng 1.2.1
libpng/libpng 1.2.2
libpng/libpng 1.2.3
libpng/libpng 1.2.4
libpng/libpng 1.2.10
libpng/libpng 1.2.11
libpng/libpng 1.2.12
... and 40 more
Published Jan 21, 2016
Tracked Since Feb 18, 2026