CVE-2020-35511 — Buffer Over-read in Pngcheck

CWE-126 — Buffer Over-readCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer5 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 76.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libpng PngcheckDebian PngcheckDebian Linux
Timeline
PublishedAug 23
Latest updateJun 21

Description

A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/pngcheck< pngcheck 3.0.2-2 (bookworm)
▶Debianlibpng/pngcheck< 3.0.3-1~deb11u1+3
▶CVEListV5libpng/pngcheckpngcheck-2.4.0
▶NVDlibpng/pngcheck2.4.0

Also affects: Debian Linux 10.0, 11.0

🔴Vulnerability Details

2
GHSA
GHSA-4p54-36pq-7qrc: A global buffer overflow was discovered in pngcheck function in pngcheck-2↗2022-08-24
▶
OSV
CVE-2020-35511: A global buffer overflow was discovered in pngcheck function in pngcheck-2↗2022-08-23
▶

📋Vendor Advisories

2
Ubuntu
pngcheck vulnerabilities↗2023-06-21
▶
Debian
CVE-2020-35511: pngcheck - A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5...↗2020
▶
CVE-2020-35511 — Buffer Over-read in Debian Pngcheck | cvebase