Test ID:	1.3.6.1.4.1.25623.1.0.120605
Category:	Amazon Linux Local Security Checks
Title:	Amazon Linux: Security Advisory (ALAS-2015-615)
Summary:	The remote host is missing an update for the 'libpng' package(s) announced via the ALAS-2015-615 advisory.
Description:	Summary: The remote host is missing an update for the 'libpng' package(s) announced via the ALAS-2015-615 advisory. Vulnerability Insight: It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library. (CVE-2015-7981) An array-indexing error was discovered in the png_convert_to_rfc1123() function of libpng. An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image. (CVE-2015-8472) Affected Software/OS: 'libpng' package(s) on Amazon Linux. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-7981 BugTraq ID: 77304 http://www.securityfocus.com/bid/77304 Debian Security Information: DSA-3399 (Google Search) http://www.debian.org/security/2015/dsa-3399 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.html https://security.gentoo.org/glsa/201611-08 http://www.openwall.com/lists/oss-security/2015/10/26/1 http://www.openwall.com/lists/oss-security/2015/10/26/3 RedHat Security Advisories: RHSA-2015:2594 http://rhn.redhat.com/errata/RHSA-2015-2594.html RedHat Security Advisories: RHSA-2015:2595 http://rhn.redhat.com/errata/RHSA-2015-2595.html RedHat Security Advisories: RHSA-2016:1430 https://access.redhat.com/errata/RHSA-2016:1430 http://www.securitytracker.com/id/1034393 SuSE Security Announcement: openSUSE-SU-2015:2099 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.html SuSE Security Announcement: openSUSE-SU-2015:2136 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.html http://www.ubuntu.com/usn/USN-2815-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-8472 http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html BugTraq ID: 78624 http://www.securityfocus.com/bid/78624 Debian Security Information: DSA-3443 (Google Search) http://www.debian.org/security/2016/dsa-3443 http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.html http://www.openwall.com/lists/oss-security/2015/12/03/6 RedHat Security Advisories: RHSA-2015:2596 http://rhn.redhat.com/errata/RHSA-2015-2596.html RedHat Security Advisories: RHSA-2016:0055 http://rhn.redhat.com/errata/RHSA-2016-0055.html RedHat Security Advisories: RHSA-2016:0056 http://rhn.redhat.com/errata/RHSA-2016-0056.html RedHat Security Advisories: RHSA-2016:0057 http://rhn.redhat.com/errata/RHSA-2016-0057.html SuSE Security Announcement: SUSE-SU-2016:0256 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html SuSE Security Announcement: SUSE-SU-2016:0265 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html SuSE Security Announcement: SUSE-SU-2016:0269 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html SuSE Security Announcement: openSUSE-SU-2016:0263 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html SuSE Security Announcement: openSUSE-SU-2016:0268 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html SuSE Security Announcement: openSUSE-SU-2016:0270 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html SuSE Security Announcement: openSUSE-SU-2016:0272 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html SuSE Security Announcement: openSUSE-SU-2016:0279 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.