CVE-2018-13785 — Integer Overflow or Wraparound in Libpng

CWE-190 — Integer Overflow or WraparoundCWE-369 — Divide By Zero16 documents8 sources
Severity
6.5MEDIUMNVD
OSV7.5
EPSS
2.9%
top 13.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
LibpngCanonical Ubuntu LinuxOracle JDK+4 more
Timeline
PublishedJul 9
Latest updateMay 13

Description

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages7 packages

▶Ubuntulibpng/libpng< 1.2.50-1ubuntu2.14.04.3+1
▶NVDlibpng/libpng1.6.34
▶NVDoracle/jdk4 versions+3
▶NVDoracle/jre4 versions+3

Also affects: Ubuntu Linux 14.04, 16.04, 17.10, 18.04

Patches

Patch: www.oracle.com ↗Patch: github.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-fj59-ccrm-8h5w: In libpng 1↗2022-05-13
▶
OSV
libpng, libpng1.6 vulnerabilities↗2018-07-11
▶
CVEList
CVE-2018-13785: In libpng 1↗2018-07-09
▶
OSV
CVE-2018-13785: In libpng 1↗2018-07-09
▶

📋Vendor Advisories

3
Ubuntu
libpng vulnerabilities↗2018-07-11
▶
Red Hat
libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service↗2018-04-05
▶
Debian
CVE-2018-13785: libpng1.6 - In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_lengt...↗2018
▶

💬Community

8
Bugzilla
CVE-2018-13785 libpng10: libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service [fedora-all]↗2018-07-11
▶
Bugzilla
CVE-2018-13785 mingw-libpng: libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service [epel-7]↗2018-07-11
▶
Bugzilla
CVE-2018-13785 mingw-libpng: libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service [fedora-all]↗2018-07-11
▶
Bugzilla
CVE-2018-13785 libpng15: libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service [fedora-all]↗2018-07-11
▶
Bugzilla
CVE-2018-13785 libpng12: libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service [fedora-all]↗2018-07-11
▶
CVE-2018-13785 — Integer Overflow or Wraparound | cvebase