CVE-2015-8540

CWE-189CWE-125 — Out-of-bounds Read15 documents7 sources
Severity
8.8HIGH
EPSS
13.5%
top 5.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Debian Debian LinuxFedoraproject FedoraLibpng Libpng+4 more
Timeline
PublishedApr 14
Latest updateMay 13

Description

Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶Ubuntulibpng< 1.2.50-1ubuntu2.14.04.2
▶NVDlibpng/libpng172 versions+171

Also affects: Debian Linux 6.0, Fedora 23, Enterprise Linux 5.0, 6.0

Patches

Patch: sourceforge.net ↗Patch: sourceforge.net ↗Patch: sourceforge.net ↗

🔴Vulnerability Details

4
GHSA
GHSA-7qhq-6293-wrx3: Integer underflow in the png_check_keyword function in pngwutil↗2022-05-13
▶
CVEList
CVE-2015-8540: Integer underflow in the png_check_keyword function in pngwutil↗2016-04-14
▶
OSV
libpng vulnerabilities↗2016-01-06
▶
OSV
CVE-2015-8540: Integer underflow in the png_check_keyword function in pngwutil↗2015-12-11
▶

📋Vendor Advisories

2
Ubuntu
libpng vulnerabilities↗2016-01-06
▶
Red Hat
libpng: underflow read in png_check_keyword()↗2015-12-10
▶

💬Community

8
Bugzilla
CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [epel-7]↗2015-12-14
▶
Bugzilla
CVE-2015-8540 libpng10: libpng: underflow read in png_check_keyword() [fedora-all]↗2015-12-14
▶
Bugzilla
CVE-2015-8540 libpng12: libpng: underflow read in png_check_keyword() [fedora-all]↗2015-12-14
▶
Bugzilla
CVE-2015-8540 libpng10: libpng: underflow read in png_check_keyword() [epel-6]↗2015-12-14
▶
Bugzilla
CVE-2015-8540 mingw-libpng: libpng: underflow read in png_check_keyword() [fedora-all]↗2015-12-14
▶
CVE-2015-8540 (HIGH CVSS 8.8) | Integer underflow in the png_check_ | cvebase.io