SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

Vulnerability Note VU#649212

libpng fails to properly initialize element pointers

Overview

Libpng contains a vulnerability in the way element pointers are handled.

I. Description

A vulnerability in the way libpng handles element pointers may result in uninitialized element pointers. This vulnerability is due to an off-by-one error introduced in multiple functions in libpng-0.89c. According to the PNG Development Group:

If the application runs out of memory during the loop, some of the element pointers will be uninitialized. Libpng will then longjmp to a cleanup process that attempts to free all of the elements in the array, including the uninitialized ones. This behavior could be forced by a malevolent input.

Note that this issue affects all versions of libpng prior to libpng-1.0.43 and libpng-1.2.35.

II. Impact

This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service.

III. Solution

Upgrade

The PNG Development Group has issued an upgrade to address this issue. See libpng version 1.2.35 for more information.

Systems Affected

VendorStatusDate NotifiedDate Updated
3com, Inc.Unknown2009-03-052009-03-05
ACCESSUnknown2009-03-052009-03-05
Alcatel-LucentUnknown2009-03-052009-03-05
Apple Computer, Inc.Unknown2009-03-052009-03-05
AT&TUnknown2009-03-052009-03-05
Avaya, Inc.Unknown2009-03-052009-03-05
Barracuda NetworksUnknown2009-03-052009-03-05
Belkin, Inc.Unknown2009-03-052009-03-05
Borderware TechnologiesUnknown2009-03-052009-03-05
BroUnknown2009-03-052009-03-05
Charlotte's Web NetworksUnknown2009-03-052009-03-05
Check Point Software TechnologiesUnknown2009-03-052009-03-05
Cisco Systems, Inc.Unknown2009-03-052009-03-05
ClavisterUnknown2009-03-052009-03-05
Computer AssociatesUnknown2009-03-052009-03-05
Computer Associates eTrust Security ManagementUnknown2009-03-052009-03-05
Conectiva Inc.Unknown2009-03-052009-03-05
Cray Inc.Unknown2009-03-052009-03-05
D-Link Systems, Inc.Unknown2009-03-052009-03-05
Debian GNU/LinuxUnknown2009-03-052009-03-05
DragonFly BSD ProjectUnknown2009-03-052009-03-05
EMC CorporationUnknown2009-03-052009-03-05
Engarde Secure LinuxUnknown2009-03-052009-03-05
Enterasys NetworksUnknown2009-03-052009-03-05
EricssonUnknown2009-03-052009-03-05
eSoft, Inc.Unknown2009-03-052009-03-05
Extreme NetworksUnknown2009-03-052009-03-05
F5 Networks, Inc.Unknown2009-03-052009-03-05
Fedora ProjectUnknown2009-03-052009-03-05
Force10 Networks, Inc.Unknown2009-03-052009-03-05
Fortinet, Inc.Unknown2009-03-052009-03-05
Foundry Networks, Inc.Unknown2009-03-052009-03-05
FreeBSD, Inc.Unknown2009-03-052009-03-05
FujitsuUnknown2009-03-052009-03-05
Gentoo LinuxUnknown2009-03-052009-03-05
Global Technology AssociatesUnknown2009-03-052009-03-05
Hewlett-Packard CompanyUnknown2009-03-052009-03-05
HitachiUnknown2009-03-052009-03-05
IBM CorporationUnknown2009-03-052009-03-05
IBM Corporation (zseries)Unknown2009-03-052009-03-05
IBM eServerUnknown2009-03-052009-03-05
Ingrian Networks, Inc.Unknown2009-03-052009-03-05
Intel CorporationUnknown2009-03-052009-03-05
Internet Security Systems, Inc.Unknown2009-03-052009-03-05
IntotoUnknown2009-03-052009-03-05
IP FilterUnknown2009-03-052009-03-05
Juniper Networks, Inc.Unknown2009-03-052009-03-05
libpngVulnerable2009-03-02
Luminous NetworksUnknown2009-03-052009-03-05
m0n0wallUnknown2009-03-052009-03-05
Mandriva S. A.Unknown2009-03-052009-03-05
McAfeeUnknown2009-03-052009-03-05
Microsoft CorporationUnknown2009-03-052009-03-05
MontaVista Software, Inc.Unknown2009-03-052009-03-05
Multitech, Inc.Unknown2009-03-052009-03-05
NEC CorporationUnknown2009-03-052009-03-05
NetAppUnknown2009-03-052009-03-05
NetBSDUnknown2009-03-052009-03-05
netfilterUnknown2009-03-052009-03-05
NokiaUnknown2009-03-052009-03-05
Nortel Networks, Inc.Unknown2009-03-052009-03-05
Novell, Inc.Unknown2009-03-052009-03-05
OpenBSDUnknown2009-03-052009-03-05
Openwall GNU/*/LinuxUnknown2009-03-052009-03-05
PePLinkUnknown2009-03-052009-03-05
Process SoftwareUnknown2009-03-052009-03-05
Q1 LabsUnknown2009-03-052009-03-05
QNX, Software Systems, Inc.Unknown2009-03-052009-03-05
QuaggaUnknown2009-03-052009-03-05
RadWare, Inc.Unknown2009-03-052009-03-05
Red Hat, Inc.Unknown2009-03-052009-03-05
Redback Networks, Inc.Unknown2009-03-052009-03-05
Secureworx, Inc.Unknown2009-03-052009-03-05
Silicon Graphics, Inc.Unknown2009-03-052009-03-05
Slackware Linux Inc.Unknown2009-03-052009-03-05
SmoothWallUnknown2009-03-052009-03-05
SnortUnknown2009-03-052009-03-05
Soapstone NetworksUnknown2009-03-052009-03-05
Sony CorporationUnknown2009-03-052009-03-05
SourcefireUnknown2009-03-052009-03-05
StonesoftUnknown2009-03-052009-03-05
Sun Microsystems, Inc.Unknown2009-03-052009-03-05
SUSE LinuxUnknown2009-03-052009-03-05
Symantec, Inc.Unknown2009-03-052009-03-05
The SCO GroupUnknown2009-03-052009-03-05
TippingPoint, Technologies, Inc.Unknown2009-03-052009-03-05
TurbolinuxUnknown2009-03-052009-03-05
U4EA Technologies, Inc.Unknown2009-03-052009-03-05
UbuntuUnknown2009-03-052009-03-05
UnisysUnknown2009-03-052009-03-05
VyattaUnknown2009-03-052009-03-05
Watchguard Technologies, Inc.Unknown2009-03-052009-03-05
Wind River Systems, Inc.Unknown2009-03-052009-03-05
ZyXELUnknown2009-03-052009-03-05

References


http://secunia.com/advisories/33970/3/

Credit

This issue was reported by the PNG Development Group in libpng version 1.2.35.

This document was written by Chris Taschner.

Other Information

Date Public:2009-02-19
Date First Published:2009-03-02
Date Last Updated:2009-03-06
CERT Advisory: 
CVE-ID(s):CVE-2009-0040
NVD-ID(s):CVE-2009-0040
US-CERT Technical Alerts: 
Metric:3.49
Document Revision:11

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2009 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader