Vulnerability Note VU#817368

libpng png_handle_sBIT() performs insufficient bounds checking

A potentially insufficient bounds check error exists within the png_handle_sBIT() function. A similar error exists in the png_handle_hIST() function. While the code that contains these errors could potentially permit a buffer overflow to occur during a subsequent png_crc_read() operation, it is unclear what practical vulnerabilities they might present in applications using libpng.

Multiple applications support the PNG image format, including web browsers, email clients, and various graphic utilities. Because multiple products have used the libpng reference library to implement native PNG image processing, multiple applications will be affected by this issue in different ways.

Please note that this vulnerability is known to exist in Microsoft Windows Messenger and MSN Messenger. Please see MS05-009 for more details. For information regarding how this vulnerability affects Microsoft Internet Explorer, refer to MS05-025.

II. Impact

Patches have been released to address this vulnerability. Please see the Systems Affected section of this document for more details.

Systems Affected

http://scary.beasts.org/security/CESA-2004-001.txt
http://www.libpng.org/pub/png/
http://libpng.sourceforge.net/
http://www.microsoft.com/technet/security/Bulletin/MS05-009.mspx
http://www.microsoft.com/technet/security/bulletin/ms05-025.mspx

Credit

Thanks to Chris Evans for reporting this vulnerability.

This document was written by Chad Dougherty and Damon Morda.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.