Skip to content
OpenAdvisories
High ALAS2-2023-1904 1 CVE

Important: libpng security update (Amazon Linux 2)

Published Jan 18, 2023 · Updated Jan 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2015-8540: Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read.

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2 libpng 2:1.5.13-8.amzn2.0.1
Amazon Linux · 2 libpng-debuginfo 2:1.5.13-8.amzn2.0.1
Amazon Linux · 2 libpng-devel 2:1.5.13-8.amzn2.0.1
Amazon Linux · 2 libpng-static 2:1.5.13-8.amzn2.0.1

Vulnerabilities 1

  • Unscored —
    CVE-2015-8540

    Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1…

    libpng Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2015-8540.html