Description
Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | clucene +1 | No fix yet | — |
| Azure Linux 3 | fltk | 1.3.8-1 | — |
| Azure Linux 3 | teckit | 2.5.12-4 | — |
| Azure Linux 2 (CBL-Mariner) | fltk +3 | No fix yet | — |