2016-07-28
ALT-BU-2016-2907-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Published: 2017-05-23
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-5735
Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow.
Severity: HIGH (7.8)
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- http://sf.snu.ac.kr/gil.hur/publications/shovel.pdf
- http://sf.snu.ac.kr/gil.hur/publications/shovel.pdf
- https://github.com/pornel/pngquant/commit/b7c217680cda02dddced245d237ebe8c383be285
- https://github.com/pornel/pngquant/commit/b7c217680cda02dddced245d237ebe8c383be285
- [debian-lts-announce] 20200628 [SECURITY] [DLA 2257-1] pngquant security update
- [debian-lts-announce] 20200628 [SECURITY] [DLA 2257-1] pngquant security update