CVE-2006-5793
published 2006-11-17CVE-2006-5793: The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows…
PriorityP410low2.6CVSS 2.0
AVNACHAuNCNINAP
EPSS
1.73%
75.0th percentile
The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
| greg_roelofs | libpng | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:N/A:P
vendor_redhat2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
libpng vulnerability
vendor_ubuntu·2006-11-17
CVE-2006-5793 libpng vulnerability
Title: libpng vulnerability
Summary: libpng vulnerability
Tavis Ormandy discovered that libpng did not correctly calculate the
size of sPLT structures when reading an image. By tricking a user or an
automated system into processing a specially crafted PNG file, an
attacker could exploit this weakness to crash the application using the
library.
Instructions: After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
Red Hat
libpng DoS
vendor_redhat·2006-11-14·CVSS 2.6
CVE-2006-5793 [LOW] libpng DoS
libpng DoS
The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.
GHSA
GHSA-gp79-46cf-7pmq: The sPLT chunk handling code (png_set_sPLT function in pngset
ghsa_unreviewed·2022-05-01
CVE-2006-5793 [LOW] CWE-20 GHSA-gp79-46cf-7pmq: The sPLT chunk handling code (png_set_sPLT function in pngset
The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-5793 libpng DoS
bugzilla·2007-06-04·CVSS 2.6
CVE-2006-5793 [LOW] CVE-2006-5793 libpng DoS
CVE-2006-5793 libpng DoS
Gah, Downloaded wrong version from RHN did not notice fix.
Discussion:
OK, thanks. Closed. - Sorry for the delay.
Internal Status set to 'Resolved'
Status set to: Closed by Client
This event sent from IssueTracker by jf.Le_Breton
issue 121073
Bugzilla
CVE-2006-5793 libpng, libpng10 DoS
bugzilla·2006-11-21·CVSS 2.6
CVE-2006-5793 [LOW] CVE-2006-5793 libpng, libpng10 DoS
CVE-2006-5793 libpng, libpng10 DoS
+++ This bug was initially created as a clone of Bug #215405 +++
Tavis Ormandy told vendor-sec about a OOB memory read flaw in libpng. This flaw
is a denial of service flaw.
quoting the mail from Tavis:
Hello, there's a typo in the sPLT chunk handling code in libpng,
potentially resulting in an OOB read. AFAICT, the extent of the
vulnerability is denial of service, but would appreciate a second pair
of eyes to verify.
Around line ~983 of pngset.c, in png_set_sPLT()
to->entries =3D (png_sPLT_entryp)png_malloc(png_ptr,=20
from->nentries * png_sizeof(png_sPLT_t));
should be `png_sizeof(png_sPLT_entry)`
and the same on this line:
png_memcpy(to->entries, from->entries,
from->nentries * png_sizeof(png_sPLT_t));
This issue also affects RHEL2.1 and RHEL
Bugzilla
CVE-2006-5793: libpng10 < 1.0.21 DoS vulnerability
bugzilla·2006-11-18·CVSS 2.6
CVE-2006-5793 [LOW] CVE-2006-5793: libpng10 < 1.0.21 DoS vulnerability
CVE-2006-5793: libpng10 < 1.0.21 DoS vulnerability
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-5793
"The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng
1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows
context-dependent attackers to cause a denial of service (crash) via malformed
sPLT chunks that trigger an out-of-bounds read."
Appears to be fixed in 1.0.21.
Discussion:
I have 1.0.21 packages prepared, but can't import and build yet due to the cvs
outage. If anyone would like a preview, I have packages here:
http://www.city-fan.org/~paul/extras/libpng10/
(no ppc packages as I don't have a ppc builder)
Note that libpng10 is a Core package for all releases prior to FC6 (and
presumably RHEL too) so separate bugs will need raising
Bugzilla
CVE-2006-5793 libpng DoS
bugzilla·2006-11-13·CVSS 2.6
CVE-2006-5793 [LOW] CVE-2006-5793 libpng DoS
CVE-2006-5793 libpng DoS
Tavis Ormandy told vendor-sec about a OOB memory read flaw in libpng. This flaw
is a denial of service flaw.
quoting the mail from Tavis:
Hello, there's a typo in the sPLT chunk handling code in libpng,
potentially resulting in an OOB read. AFAICT, the extent of the
vulnerability is denial of service, but would appreciate a second pair
of eyes to verify.
Around line ~983 of pngset.c, in png_set_sPLT()
to->entries =3D (png_sPLT_entryp)png_malloc(png_ptr,=20
from->nentries * png_sizeof(png_sPLT_t));
should be `png_sizeof(png_sPLT_entry)`
and the same on this line:
png_memcpy(to->entries, from->entries,
from->nentries * png_sizeof(png_sPLT_t));
This issue also affects RHEL2.1 and RHEL3
Discussion:
This issue is now public:
http://bugs.gentoo.org/show_bug.cg
http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.htmlhttp://bugs.gentoo.org/attachment.cgi?id=101400&action=viewhttp://bugs.gentoo.org/show_bug.cgi?id=154380http://docs.info.apple.com/article.html?artnum=307562http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://secunia.com/advisories/22889http://secunia.com/advisories/22900http://secunia.com/advisories/22941http://secunia.com/advisories/22950http://secunia.com/advisories/22951http://secunia.com/advisories/22956http://secunia.com/advisories/22958http://secunia.com/advisories/23208http://secunia.com/advisories/23335http://secunia.com/advisories/25329http://secunia.com/advisories/25742http://secunia.com/advisories/29420http://security.gentoo.org/glsa/glsa-200611-09.xmlhttp://securitytracker.com/id?1017244http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.465035http://sourceforge.net/project/shownotes.php?release_id=464278http://support.avaya.com/elmodocs2/security/ASA-2007-254.htmhttp://www.coresecurity.com/?action=item&id=2148http://www.mandriva.com/security/advisories?name=MDKSA-2006:209http://www.mandriva.com/security/advisories?name=MDKSA-2006:210http://www.mandriva.com/security/advisories?name=MDKSA-2006:211http://www.mandriva.com/security/advisories?name=MDKSA-2006:212http://www.novell.com/linux/security/advisories/2006_28_sr.htmlhttp://www.openpkg.com/security/advisories/OpenPKG-SA-2006.036.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0356.htmlhttp://www.securityfocus.com/archive/1/451874/100/200/threadedhttp://www.securityfocus.com/archive/1/453484/100/100/threadedhttp://www.securityfocus.com/archive/1/489135/100/0/threadedhttp://www.securityfocus.com/bid/21078http://www.trustix.org/errata/2006/0065/http://www.ubuntu.com/usn/usn-383-1http://www.vupen.com/english/advisories/2006/4521http://www.vupen.com/english/advisories/2006/4568http://www.vupen.com/english/advisories/2008/0924/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/30290https://issues.rpath.com/browse/RPL-790https://issues.rpath.com/browse/RPL-824https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10324http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.htmlhttp://bugs.gentoo.org/attachment.cgi?id=101400&action=viewhttp://bugs.gentoo.org/show_bug.cgi?id=154380http://docs.info.apple.com/article.html?artnum=307562http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlhttp://secunia.com/advisories/22889http://secunia.com/advisories/22900http://secunia.com/advisories/22941http://secunia.com/advisories/22950http://secunia.com/advisories/22951http://secunia.com/advisories/22956http://secunia.com/advisories/22958http://secunia.com/advisories/23208http://secunia.com/advisories/23335http://secunia.com/advisories/25329http://secunia.com/advisories/25742http://secunia.com/advisories/29420http://security.gentoo.org/glsa/glsa-200611-09.xmlhttp://securitytracker.com/id?1017244http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.465035http://sourceforge.net/project/shownotes.php?release_id=464278http://support.avaya.com/elmodocs2/security/ASA-2007-254.htmhttp://www.coresecurity.com/?action=item&id=2148http://www.mandriva.com/security/advisories?name=MDKSA-2006:209http://www.mandriva.com/security/advisories?name=MDKSA-2006:210http://www.mandriva.com/security/advisories?name=MDKSA-2006:211http://www.mandriva.com/security/advisories?name=MDKSA-2006:212http://www.novell.com/linux/security/advisories/2006_28_sr.htmlhttp://www.openpkg.com/security/advisories/OpenPKG-SA-2006.036.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0356.htmlhttp://www.securityfocus.com/archive/1/451874/100/200/threadedhttp://www.securityfocus.com/archive/1/453484/100/100/threadedhttp://www.securityfocus.com/archive/1/489135/100/0/threadedhttp://www.securityfocus.com/bid/21078http://www.trustix.org/errata/2006/0065/http://www.ubuntu.com/usn/usn-383-1http://www.vupen.com/english/advisories/2006/4521http://www.vupen.com/english/advisories/2006/4568http://www.vupen.com/english/advisories/2008/0924/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/30290https://issues.rpath.com/browse/RPL-790https://issues.rpath.com/browse/RPL-824https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10324
2006-11-17
Published