CVE-2021-4214 — Classic Buffer Overflow in Libpng

CWE-120 — Classic Buffer OverflowCWE-787 — Out-of-bounds Write6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 67.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
LibpngDebian Linux
Timeline
PublishedAug 24
Latest updateAug 25

Description

A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5libpng/libpnglibpng v1.6
▶NVDlibpng/libpng1.6.0

Also affects: Debian Linux 10.0, 11.0

🔴Vulnerability Details

3
GHSA
GHSA-v3c8-fhq3-xvvh: A heap overflow flaw was found in libpngs' pngimage↗2022-08-25
▶
CVEList
CVE-2021-4214: A heap overflow flaw was found in libpngs' pngimage↗2022-08-24
▶
OSV
CVE-2021-4214: A heap overflow flaw was found in libpngs' pngimage↗2022-08-24
▶

📋Vendor Advisories

2
Debian
CVE-2021-4214: libpng1.6 - A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows ...↗2021
▶
Red Hat
libpng: hardcoded value leads to heap-overflow↗2019-06-25
▶