CVE-2013-7353 — Heap-based Buffer Overflow in Libpng

CWE-189CWE-122 — Heap-based Buffer OverflowCWE-190 — Integer Overflow or Wraparound14 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 38.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Libpng
Timeline
PublishedMay 6
Latest updateMay 17

Description

Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDlibpng/libpng1.5.13+14

🔴Vulnerability Details

3
GHSA
GHSA-hr5g-ggm4-mgqr: Integer overflow in the png_set_unknown_chunks function in libpng/pngset↗2022-05-17
▶
OSV
CVE-2013-7353: Integer overflow in the png_set_unknown_chunks function in libpng/pngset↗2014-05-06
▶
CVEList
CVE-2013-7353: Integer overflow in the png_set_unknown_chunks function in libpng/pngset↗2014-05-06
▶

📋Vendor Advisories

2
Red Hat
libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks()↗2014-04-11
▶
Debian
CVE-2013-7353: libpng1.6 - Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in li...↗2013
▶

📄Research Papers

1
arXiv
A Semantics-Based Hybrid Approach on Binary Code Similarity Comparison↗2019-07-01
▶

💬Community

7
Bugzilla
CVE-2013-7353 CVE-2013-7354 mingw32-libpng: various flaws [epel-5]↗2014-04-11
▶
Bugzilla
CVE-2013-7353 CVE-2013-7354 mingw-libpng: various flaws [fedora-19]↗2014-04-11
▶
Bugzilla
CVE-2013-7353 CVE-2013-7354 libpng: various flaws [fedora-19]↗2014-04-11
▶
Bugzilla
CVE-2013-7353 CVE-2013-7354 mingw32-libpng: various flaws [epel-6]↗2014-04-11
▶
Bugzilla
CVE-2013-7353 CVE-2013-7354 libpng15: various flaws [fedora-20]↗2014-04-11
▶