English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 61204 CVE descriptions
and 32582 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.63513
Category:Ubuntu Local Security Checks
Title:Ubuntu USN-730-1 (libpng)
Summary:Ubuntu USN-730-1 (libpng)
Description:The remote host is missing an update to libpng
announced via advisory USN-730-1.

Details follow:

It was discovered that libpng did not properly perform bounds checking in
certain operations. An attacker could send a specially crafted PNG image and
cause a denial of service in applications linked against libpng. This issue
only affected Ubuntu 8.04 LTS. (CVE-2007-5268, CVE-2007-5269)

Tavis Ormandy discovered that libpng did not properly initialize memory. If a
user or automated system were tricked into opening a crafted PNG image, an
attacker could cause a denial of service via application crash, or possibly
execute arbitrary code with the privileges of the user invoking the program.
This issue did not affect Ubuntu 8.10. (CVE-2008-1382)

Harald van Dijk discovered an off-by-one error in libpng. An attacker could
could cause an application crash in programs using pngtest. (CVE-2008-3964)

It was discovered that libpng did not properly NULL terminate a keyword
string. An attacker could exploit this to set arbitrary memory locations to
zero. (CVE-2008-5907)

Glenn Randers-Pehrson discovered that libpng did not properly initialize
pointers. If a user or automated system were tricked into opening a crafted PNG
file, an attacker could cause a denial of service or possibly execute arbitrary
code with the privileges of the user invoking the program. (CVE-2009-0040)

Solution:
The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
libpng12-0 1.2.8rel-5ubuntu0.4

Ubuntu 7.10:
libpng12-0 1.2.15~
beta5-2ubuntu0.2

Ubuntu 8.04 LTS:
libpng12-0 1.2.15~
beta5-3ubuntu0.1

Ubuntu 8.10:
libpng12-0 1.2.27-1ubuntu0.1

After a standard system upgrade you need to reboot your computer to
effect the necessary changes.

http://www.securityspace.com/smysecure/catid.html?in=USN-730-1
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2007-5268
Bugtraq: 20071112 FLEA-2007-0065-1 libpng (Google Search)
http://www.securityfocus.com/archive/1/archive/1/483582/100/0/threaded
Bugtraq: 20080304 CORE-2008-0124: Multiple vulnerabilities in Google's Android SDK (Google Search)
http://www.securityfocus.com/archive/1/archive/1/489135/100/0/threaded
http://sourceforge.net/mailarchive/message.php?msg_name=5122753600C3E94F87FBDFFCC090D1FF0400EBC5%40MERCMBX07.na.sas.com
http://sourceforge.net/mailarchive/message.php?msg_name=e56ccc8f0709140846k24e9a040r81623783b6b1c00f%40mail.gmail.com
http://sourceforge.net/mailarchive/forum.php?thread_name=3.0.6.32.20071004082318.012a7628%40mail.comcast.net&forum_name=png-mng-implement
http://www.coresecurity.com/?action=item&id=2148
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
http://www.gentoo.org/security/en/glsa/glsa-200711-08.xml
http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:217
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.520323
http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1
http://www.ubuntu.com/usn/usn-538-1
Cert/CC Advisory: TA08-150A
http://www.us-cert.gov/cas/techalerts/TA08-150A.html
BugTraq ID: 25956
http://www.securityfocus.com/bid/25956
http://secunia.com/advisories/35302
http://secunia.com/advisories/35386
http://www.vupen.com/english/advisories/2007/3390
http://www.vupen.com/english/advisories/2008/0924/references
http://www.vupen.com/english/advisories/2008/1697
http://secunia.com/advisories/27093
http://secunia.com/advisories/27284
http://secunia.com/advisories/27405
http://secunia.com/advisories/27529
http://secunia.com/advisories/27629
http://secunia.com/advisories/27746
http://secunia.com/advisories/29420
http://secunia.com/advisories/30161
http://secunia.com/advisories/30430
http://www.vupen.com/english/advisories/2009/1462
http://www.vupen.com/english/advisories/2009/1560
Common Vulnerability Exposure (CVE) ID: CVE-2007-5269
Bugtraq: 20080318 VMSA-2008-0005 Updated VMware Workstation, VMware Player, VMware Server, VMware ACE, and VMware Fusion resolve critical security issues (Google Search)
http://www.securityfocus.com/archive/1/archive/1/489739/100/0/threaded
Bugtraq: 20080830 VMSA-2008-0014 Updates to VMware Workstation, VMware Player, VMware ACE, VMware Server, VMware ESX address information disclosure, privilege escalation and other security issues. (Google Search)
http://www.securityfocus.com/archive/1/archive/1/495869/100/0/threaded
http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html
http://lists.vmware.com/pipermail/security-announce/2008/000008.html
Debian Security Information: DSA-1750 (Google Search)
http://www.debian.org/security/2009/dsa-1750
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00353.html
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00356.html
https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00072.html
http://www.redhat.com/support/errata/RHSA-2007-0992.html
SuSE Security Announcement: SUSE-SR:2007:025 (Google Search)
http://www.novell.com/linux/security/advisories/2007_25_sr.html
BugTraq ID: 28276
http://www.securityfocus.com/bid/28276
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10614
http://secunia.com/advisories/34388
http://www.vupen.com/english/advisories/2008/0905/references
http://www.vupen.com/english/advisories/2008/2466
http://www.securitytracker.com/id?1018849
http://secunia.com/advisories/27369
http://secunia.com/advisories/27391
http://secunia.com/advisories/27492
http://secunia.com/advisories/27662
http://secunia.com/advisories/27965
http://secunia.com/advisories/31712
http://secunia.com/advisories/31713
Common Vulnerability Exposure (CVE) ID: CVE-2008-1382
Bugtraq: 20080414 [oCERT-2008-003] libpng zero-length chunks incorrect handling (Google Search)
http://www.securityfocus.com/archive/1/archive/1/490823/100/0/threaded
Bugtraq: 20080429 rPSA-2008-0151-1 libpng (Google Search)
http://www.securityfocus.com/archive/1/archive/1/491424/100/0/threaded
Bugtraq: 20090529 VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues (Google Search)
http://www.securityfocus.com/archive/1/archive/1/503912/100/0/threaded
http://www.ocert.org/advisories/ocert-2008-003.html
http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00721.html
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00960.html
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00951.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00033.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00080.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00111.html
http://security.gentoo.org/glsa/glsa-200804-15.xml
http://security.gentoo.org/glsa/glsa-200805-10.xml
http://security.gentoo.org/glsa/glsa-200812-15.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:156
http://www.redhat.com/support/errata/RHSA-2009-0333.html
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.541247
SuSE Security Announcement: SUSE-SR:2008:010 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html
Cert/CC Advisory: TA08-260A
http://www.us-cert.gov/cas/techalerts/TA08-260A.html
Cert/CC Advisory: TA09-133A
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
BugTraq ID: 28770
http://www.securityfocus.com/bid/28770
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10326
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6275
http://secunia.com/advisories/35074
http://secunia.com/advisories/35258
http://secunia.com/advisories/34152
http://www.vupen.com/english/advisories/2008/1225/references
http://www.vupen.com/english/advisories/2008/2584
http://www.osvdb.org/44364
http://www.securitytracker.com/id?1019840
http://secunia.com/advisories/29792
http://secunia.com/advisories/29678
http://secunia.com/advisories/29992
http://secunia.com/advisories/29957
http://secunia.com/advisories/30009
http://secunia.com/advisories/30402
http://secunia.com/advisories/30486
http://secunia.com/advisories/31882
http://secunia.com/advisories/30157
http://secunia.com/advisories/30174
http://secunia.com/advisories/33137
http://www.vupen.com/english/advisories/2009/1297
http://www.vupen.com/english/advisories/2009/1451
XForce ISS Database: libpng-zero-length-code-execution(41800)
http://xforce.iss.net/xforce/xfdb/41800
Common Vulnerability Exposure (CVE) ID: CVE-2008-3964
http://www.openwall.com/lists/oss-security/2008/09/09/3
http://www.openwall.com/lists/oss-security/2008/09/09/8
http://sourceforge.net/mailarchive/forum.php?thread_name=e56ccc8f0809180317u6a5306fg14683947affb3e1b%40mail.gmail.com&forum_name=png-mng-implement
http://www.mandriva.com/security/advisories?name=MDVSA-2009:051
CERT/CC vulnerability note: VU#889484
http://www.kb.cert.org/vuls/id/889484
BugTraq ID: 31049
http://www.securityfocus.com/bid/31049
http://secunia.com/advisories/31781
http://www.vupen.com/english/advisories/2008/2512
XForce ISS Database: libpng-pngpushreadztxt-dos(44928)
http://xforce.iss.net/xforce/xfdb/44928
Common Vulnerability Exposure (CVE) ID: CVE-2008-5907
http://openwall.com/lists/oss-security/2009/01/09/1
http://sourceforge.net/mailarchive/forum.php?thread_name=4B6F0239C13D0245820603C036D180BC79FBAA%40CABOTUKEXCH01.cabot.local&forum_name=png-mng-implement
http://security.gentoo.org/glsa/glsa-200903-28.xml
SuSE Security Announcement: SUSE-SR:2009:003 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
http://secunia.com/advisories/34320
XForce ISS Database: libpng-pngcheckkeyword-memory-corruption(48128)
http://xforce.iss.net/xforce/xfdb/48128
Common Vulnerability Exposure (CVE) ID: CVE-2009-0040
Bugtraq: 20090312 rPSA-2009-0046-1 libpng (Google Search)
http://www.securityfocus.com/archive/1/archive/1/501767/100/0/threaded
Bugtraq: 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server (Google Search)
http://www.securityfocus.com/archive/1/archive/1/505990/100/0/threaded
http://sourceforge.net/mailarchive/message.php?msg_name=e56ccc8f0902181726i200f4bf0n20d919473ec409b7%40mail.gmail.com
http://lists.vmware.com/pipermail/security-announce/2009/000062.html
http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html
Debian Security Information: DSA-1830 (Google Search)
http://www.debian.org/security/2009/dsa-1830
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00412.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00272.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00769.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00771.html
http://www.mandriva.com/security/advisories?name=MDVSA-2009:075
http://www.mandriva.com/security/advisories?name=MDVSA-2009:083
http://www.redhat.com/support/errata/RHSA-2009-0315.html
http://www.redhat.com/support/errata/RHSA-2009-0325.html
http://www.redhat.com/support/errata/RHSA-2009-0340.html
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.433952
SuSE Security Announcement: SUSE-SR:2009:005 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html
SuSE Security Announcement: SUSE-SA:2009:012 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html
SuSE Security Announcement: SUSE-SA:2009:023 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html
Cert/CC Advisory: TA09-218A
http://www.us-cert.gov/cas/techalerts/TA09-218A.html
CERT/CC vulnerability note: VU#649212
http://www.kb.cert.org/vuls/id/649212
BugTraq ID: 33827
http://www.securityfocus.com/bid/33827
BugTraq ID: 33990
http://www.securityfocus.com/bid/33990
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10316
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6458
http://secunia.com/advisories/34145
http://secunia.com/advisories/34210
http://secunia.com/advisories/34265
http://secunia.com/advisories/34272
http://secunia.com/advisories/34324
http://secunia.com/advisories/34462
http://secunia.com/advisories/34464
http://secunia.com/advisories/35379
http://secunia.com/advisories/36096
http://secunia.com/advisories/34137
http://secunia.com/advisories/34140
http://secunia.com/advisories/34143
http://www.vupen.com/english/advisories/2009/0469
http://www.vupen.com/english/advisories/2009/0473
http://secunia.com/advisories/33970
http://secunia.com/advisories/33976
http://www.vupen.com/english/advisories/2009/0632
http://www.vupen.com/english/advisories/2009/1522
http://www.vupen.com/english/advisories/2009/1621
http://www.vupen.com/english/advisories/2009/2172
XForce ISS Database: libpng-pointer-arrays-code-execution(48819)
http://xforce.iss.net/xforce/xfdb/48819
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.