National Cyber-Alert System

Vulnerability Summary for CVE-2006-3334

Overview

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to "chunk error processing," possibly involving the "chunk_name".

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

Upgrade to 1.2.12}

Vendor Statments (disclaimer)

Official Statement from Red Hat (05/14/2007)

On Red Hat Enterprise Linux 2.1, 3, 4, and 5 this is a two-byte overflow into the middle of the stack and is not exploitable.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2006-2585

Type: Advisory; Patch Information

Hyperlink:http://www.frsirt.com/english/advisories/2006/2585

External Source: BID

Name: 18698

Hyperlink:http://www.securityfocus.com/bid/18698

External Source: CONFIRM

Name: http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=428123

Hyperlink:http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=428123

External Source: GENTOO

Name: GLSA-200812-15

Hyperlink:http://security.gentoo.org/glsa/glsa-200812-15.xml

External Source: SECUNIA

Name: 33137

Hyperlink:http://secunia.com/advisories/33137

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-517

Hyperlink:https://issues.rpath.com/browse/RPL-517

External Source: XF

Name: libpng-pngdecompresschunk-bo(27468)

Hyperlink:http://xforce.iss.net/xforce/xfdb/27468

External Source: BUGTRAQ

Name: 20060719 rPSA-2006-0133-1 libpng

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/440594/100/0/threaded

External Source: SUSE

Name: SUSE-SR:2006:028

Hyperlink:http://www.novell.com/linux/security/advisories/2006_28_sr.html

External Source: SUSE

Name: SUSE-SR:2006:016

Hyperlink:http://www.novell.com/linux/security/advisories/2006_16_sr.html

External Source: MANDRIVA

Name: MDKSA-2006:213

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:213

External Source: MANDRIVA

Name: MDKSA-2006:212

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:212

External Source: MANDRIVA

Name: MDKSA-2006:211

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:211

External Source: MANDRIVA

Name: MDKSA-2006:210

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:210

External Source: MANDRIVA

Name: MDKSA-2006:209

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:209

External Source: VUPEN

Name: ADV-2008-0924

Hyperlink:http://www.frsirt.com/english/advisories/2008/0924/references

External Source: GENTOO

Name: GLSA-200607-06

Hyperlink:http://security.gentoo.org/glsa/glsa-200607-06.xml

External Source: SECUNIA

Name: 29420

Hyperlink:http://secunia.com/advisories/29420

External Source: SECUNIA

Name: 23335

Hyperlink:http://secunia.com/advisories/23335

External Source: SECUNIA

Name: 22958

Hyperlink:http://secunia.com/advisories/22958

External Source: SECUNIA

Name: 22957

Hyperlink:http://secunia.com/advisories/22957

External Source: SECUNIA

Name: 22956

Hyperlink:http://secunia.com/advisories/22956

External Source: SECUNIA

Name: 20960

Hyperlink:http://secunia.com/advisories/20960

External Source: APPLE

Name: APPLE-SA-2008-03-18

Hyperlink:http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

External Source: MANDRIVA

Name: MDKSA-2006:213

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:213

External Source: MANDRIVA

Name: MDKSA-2006:212

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:212

External Source: MANDRIVA

Name: MDKSA-2006:211

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:211

External Source: MANDRIVA

Name: MDKSA-2006:210

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:210

External Source: MANDRIVA

Name: MDKSA-2006:209

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:209

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=307562

Hyperlink:http://docs.info.apple.com/article.html?artnum=307562