Description
Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpng1.6 | 1.6.10-1 | — |
| Debian 13 | libpng1.6 | 1.6.10-1 | — |
| Debian 12 | libpng1.6 | 1.6.10-1 | — |
References
- http://sourceforge.net/p/libpng/bugs/199/
- openSUSE-SU-2014:0604 vendor-advisory
- 67345 vdb-entry
- [oss-security] 20140410 CVE-2013-7353 CVE-2013-7354 libpng integer overflows mailing-list