CVE-2015-8126
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
- Score
- CVSS 2.0 7.5 High
- Status
- Modified - cve@mitre.org
- Published
- 2015-11-13
- Last modified
- 2026-10-14
- Weaknesses
- CWE-120
Affected products
- Mac Os X (Apple)
- Ubuntu Linux (Canonical)
- Debian Linux (Debian)
- Fedora (Fedoraproject)
- Libpng (Libpng)
- Leap (Opensuse)
- Opensuse (Opensuse)
- Jdk (Oracle)
- Jre (Oracle)
- Linux (Oracle)
- Solaris (Oracle)
- Enterprise Linux Desktop (Redhat)
- Enterprise Linux Eus (Redhat)
- Enterprise Linux Server (Redhat)
- Enterprise Linux Server Aus (Redhat)
- Enterprise Linux Server Tus (Redhat)
- Enterprise Linux Workstation (Redhat)
- Satellite (Redhat)
- Linux Enterprise Desktop (Suse)
- Linux Enterprise Server (Suse)
References
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.html
- https://support.apple.com/HT206167
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.html
- http://www.securityfocus.com/bid/77568
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172324.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.html
- https://security.gentoo.org/glsa/201611-08
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html
- http://www.debian.org/security/2016/dsa-3507
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.html
- http://www.securitytracker.com/id/1034142
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- https://access.redhat.com/errata/RHSA-2016:1430
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.html
- http://www.debian.org/security/2015/dsa-3399
- http://rhn.redhat.com/errata/RHSA-2015-2595.html
- http://rhn.redhat.com/errata/RHSA-2015-2596.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00062.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172823.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172769.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10148
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.html
