Bug 690200 – libpng10, libpng: Memory leak by write of iCCP chunk with negative embedded profile length (CVE-2006-7244, CVE-2009-5063)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 690200 - (CVE-2006-7244, CVE-2009-5063) libpng10, libpng: Memory leak by write of iCCP chunk with negative embedded profile length (CVE-2006-7244, CVE-2009-5063)

Summary:	libpng10, libpng: Memory leak by write of iCCP chunk with negative embedded p...

Status:	CLOSED NOTABUG

Aliases:	CVE-2006-7244, CVE-2009-5063

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	public=20090801,reported=20110322,sou...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2011-03-23 11:03 EDT by Jan Lieskovsky
Modified:	2016-03-04 07:23 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2011-04-07 16:06:56 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Jan Lieskovsky 2011-03-23 11:03:25 EDT

A memory leak was found in the way libpng, PNG image format files
manipulating library, processed image files with negative length
of embedded International Color Consortium (ICC) profile chunk.
A remote attacker could provide a specially-crafted JPEG image
format file and trick the local user into opening it with an
application linked against libpng, which would result in
denial of service (excessive memory consumption or that particular
application crash).

References:
[1] http://www.openwall.com/lists/oss-security/2011/03/22/7 (CVE Request)

Comment 1 Jan Lieskovsky 2011-03-23 11:05:34 EDT

As noted in [1]:
i), the bug was introduced in 1.2.13beta1:

http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=0ff85c6923d2c4fca4ac0bad28e387e3b1777d7a#patch19

ii), and finally fixed in 1.2.39beta5:

http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9e88fcd58c8ce7f2183bc2045e5180cba0043f09#patch19

Comment 2 Jan Lieskovsky 2011-03-23 11:08:41 EDT

This issue did NOT affect the version of the libpng10 package, as shipped
with Red Hat Enterprise Linux 4.

This issue did NOT affect the versions of the libpng package, as shipped
with Red Hat Enterprise Linux 4, 5, and 6.

--

This issue did NOT affect the versions of the libpng10 package, as shipped
with Fedora release of 13 and 14 and as present within EPEL-6 repository,
as they already contain a fix for the issue.

This issue did NOT affect the versions of the libpng package, as shipped
with Fedora release of 13 and 14, as they already include the fix for
the issue.

Comment 3 Paul Howarth 2011-03-23 11:17:09 EDT

For completeness, it's also worth noting that there is no EPEL-5 package of libpng10, nor was it shipped with Red Hat Enterprise Linux 5.

Comment 4 Tom Lane 2011-03-23 11:44:20 EDT

In the current RHEL4 and RHEL5 packages, the embedded profile length is simply ignored.  While that might be a bug in itself, there's no security impact AFAICS.

Comment 5 Josh Bressers 2011-04-07 16:03:23 EDT

Statement:

These flaws do not affect any version of libpng shipped with Red Hat Enterprise Linux.

Note You need to log in before you can comment on or make changes to this bug.