The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libpng | Libpng | 0.8 (including) | 0.8 (including) |
| Libpng | Libpng | 0.71 (including) | 0.71 (including) |
| Libpng | Libpng | 0.81 (including) | 0.81 (including) |
| Libpng | Libpng | 0.82 (including) | 0.82 (including) |
| Libpng | Libpng | 0.85 (including) | 0.85 (including) |
| Libpng | Libpng | 0.86 (including) | 0.86 (including) |
| Libpng | Libpng | 0.87 (including) | 0.87 (including) |
| Libpng | Libpng | 0.88 (including) | 0.88 (including) |
| Libpng | Libpng | 0.89 (including) | 0.89 (including) |
| Libpng | Libpng | 0.89c (including) | 0.89c (including) |
| Libpng | Libpng | 0.90 (including) | 0.90 (including) |
| Libpng | Libpng | 0.95 (including) | 0.95 (including) |
| Libpng | Libpng | 0.96 (including) | 0.96 (including) |
| Libpng | Libpng | 0.97 (including) | 0.97 (including) |
| Libpng | Libpng | 0.98 (including) | 0.98 (including) |
| Libpng | Libpng | 0.99 (including) | 0.99 (including) |
| Libpng | Libpng | 0.99a (including) | 0.99a (including) |
| Libpng | Libpng | 0.99b (including) | 0.99b (including) |
| Libpng | Libpng | 0.99c (including) | 0.99c (including) |
| Libpng | Libpng | 0.99d (including) | 0.99d (including) |
| Libpng | Libpng | 0.99e (including) | 0.99e (including) |
| Libpng | Libpng | 0.99f (including) | 0.99f (including) |
| Libpng | Libpng | 0.99g (including) | 0.99g (including) |
| Libpng | Libpng | 0.99h (including) | 0.99h (including) |
| Libpng | Libpng | 1.00 (including) | 1.00 (including) |
| Libpng | Libpng | 1.0.0 (including) | 1.0.0 (including) |
| Libpng | Libpng | 1.0.0a (including) | 1.0.0a (including) |
| Libpng | Libpng | 1.0.0b (including) | 1.0.0b (including) |
| Libpng | Libpng | 1.0.1 (including) | 1.0.1 (including) |
| Libpng | Libpng | 1.0.1a (including) | 1.0.1a (including) |
| Libpng | Libpng | 1.0.1b (including) | 1.0.1b (including) |
| Libpng | Libpng | 1.0.1c (including) | 1.0.1c (including) |
| Libpng | Libpng | 1.0.1d (including) | 1.0.1d (including) |
| Libpng | Libpng | 1.0.1e (including) | 1.0.1e (including) |
| Libpng | Libpng | 1.0.2 (including) | 1.0.2 (including) |
| Libpng | Libpng | 1.0.2a (including) | 1.0.2a (including) |
| Libpng | Libpng | 1.0.3 (including) | 1.0.3 (including) |
| Libpng | Libpng | 1.0.3a (including) | 1.0.3a (including) |
| Libpng | Libpng | 1.0.3b (including) | 1.0.3b (including) |
| Libpng | Libpng | 1.0.3d (including) | 1.0.3d (including) |
| Libpng | Libpng | 1.0.4 (including) | 1.0.4 (including) |
| Libpng | Libpng | 1.0.4a (including) | 1.0.4a (including) |
| Libpng | Libpng | 1.0.4b (including) | 1.0.4b (including) |
| Libpng | Libpng | 1.0.4c (including) | 1.0.4c (including) |
| Libpng | Libpng | 1.0.4d (including) | 1.0.4d (including) |
| Libpng | Libpng | 1.0.4e (including) | 1.0.4e (including) |
| Libpng | Libpng | 1.0.4f (including) | 1.0.4f (including) |
| Libpng | Libpng | 1.0.5 (including) | 1.0.5 (including) |
| Libpng | Libpng | 1.0.5a (including) | 1.0.5a (including) |
| Libpng | Libpng | 1.0.5b (including) | 1.0.5b (including) |
| Libpng | Libpng | 1.0.5c (including) | 1.0.5c (including) |
| Libpng | Libpng | 1.0.5d (including) | 1.0.5d (including) |
| Libpng | Libpng | 1.0.5e (including) | 1.0.5e (including) |
| Libpng | Libpng | 1.0.5f (including) | 1.0.5f (including) |
| Libpng | Libpng | 1.0.5g (including) | 1.0.5g (including) |
| Libpng | Libpng | 1.0.5h (including) | 1.0.5h (including) |
| Libpng | Libpng | 1.0.5i (including) | 1.0.5i (including) |
| Libpng | Libpng | 1.0.5j (including) | 1.0.5j (including) |
| Libpng | Libpng | 1.0.5k (including) | 1.0.5k (including) |
| Libpng | Libpng | 1.0.5l (including) | 1.0.5l (including) |
| Libpng | Libpng | 1.0.5m (including) | 1.0.5m (including) |
| Libpng | Libpng | 1.0.5n (including) | 1.0.5n (including) |
| Libpng | Libpng | 1.0.5o (including) | 1.0.5o (including) |
| Libpng | Libpng | 1.0.5p (including) | 1.0.5p (including) |
| Libpng | Libpng | 1.0.5q (including) | 1.0.5q (including) |
| Libpng | Libpng | 1.0.5r (including) | 1.0.5r (including) |
| Libpng | Libpng | 1.0.5s (including) | 1.0.5s (including) |
| Libpng | Libpng | 1.0.5t (including) | 1.0.5t (including) |
| Libpng | Libpng | 1.0.5u (including) | 1.0.5u (including) |
| Libpng | Libpng | 1.0.5v (including) | 1.0.5v (including) |
| Libpng | Libpng | 1.0.6 (including) | 1.0.6 (including) |
| Libpng | Libpng | 1.0.6d (including) | 1.0.6d (including) |
| Libpng | Libpng | 1.0.6e (including) | 1.0.6e (including) |
| Libpng | Libpng | 1.0.6f (including) | 1.0.6f (including) |
| Libpng | Libpng | 1.0.6g (including) | 1.0.6g (including) |
| Libpng | Libpng | 1.0.6h (including) | 1.0.6h (including) |
| Libpng | Libpng | 1.0.6i (including) | 1.0.6i (including) |
| Libpng | Libpng | 1.0.6j (including) | 1.0.6j (including) |
| Libpng | Libpng | 1.0.7 (including) | 1.0.7 (including) |
| Libpng | Libpng | 1.0.8 (including) | 1.0.8 (including) |
| Libpng | Libpng | 1.0.9 (including) | 1.0.9 (including) |
| Libpng | Libpng | 1.0.10 (including) | 1.0.10 (including) |
| Libpng | Libpng | 1.0.11 (including) | 1.0.11 (including) |
| Libpng | Libpng | 1.0.12 (including) | 1.0.12 (including) |
| Libpng | Libpng | 1.0.13 (including) | 1.0.13 (including) |
| Libpng | Libpng | 1.0.14 (including) | 1.0.14 (including) |
| Libpng | Libpng | 1.0.15 (including) | 1.0.15 (including) |
| Libpng | Libpng | 1.0.16 (including) | 1.0.16 (including) |
| Libpng | Libpng | 1.0.17 (including) | 1.0.17 (including) |
| Libpng | Libpng | 1.0.18 (including) | 1.0.18 (including) |
| Libpng | Libpng | 1.0.19 (including) | 1.0.19 (including) |
| Libpng | Libpng | 1.0.20 (including) | 1.0.20 (including) |
| Libpng | Libpng | 1.0.21 (including) | 1.0.21 (including) |
| Libpng | Libpng | 1.0.22 (including) | 1.0.22 (including) |
| Libpng | Libpng | 1.0.23 (including) | 1.0.23 (including) |
| Libpng | Libpng | 1.0.24 (including) | 1.0.24 (including) |
| Libpng | Libpng | 1.0.25 (including) | 1.0.25 (including) |
| Libpng | Libpng | 1.0.26 (including) | 1.0.26 (including) |
| Libpng | Libpng | 1.0.27 (including) | 1.0.27 (including) |
| Libpng | Libpng | 1.0.28 (including) | 1.0.28 (including) |
| Libpng | Libpng | 1.0.29 (including) | 1.0.29 (including) |
| Libpng | Libpng | 1.0.30 (including) | 1.0.30 (including) |
| Libpng | Libpng | 1.0.31 (including) | 1.0.31 (including) |
| Libpng | Libpng | 1.0.32 (including) | 1.0.32 (including) |
| Libpng | Libpng | 1.0.33 (including) | 1.0.33 (including) |
| Libpng | Libpng | 1.0.34 (including) | 1.0.34 (including) |
| Libpng | Libpng | 1.0.35 (including) | 1.0.35 (including) |
| Libpng | Libpng | 1.0.37 (including) | 1.0.37 (including) |
| Libpng | Libpng | 1.0.38 (including) | 1.0.38 (including) |
| Libpng | Libpng | 1.0.39 (including) | 1.0.39 (including) |
| Libpng | Libpng | 1.0.40 (including) | 1.0.40 (including) |
| Libpng | Libpng | 1.0.41 (including) | 1.0.41 (including) |
| Libpng | Libpng | 1.0.42 (including) | 1.0.42 (including) |
| Libpng | Libpng | 1.0.43 (including) | 1.0.43 (including) |
| Libpng | Libpng | 1.0.44 (including) | 1.0.44 (including) |
| Libpng | Libpng | 1.0.45 (including) | 1.0.45 (including) |
| Libpng | Libpng | 1.0.46 (including) | 1.0.46 (including) |
| Libpng | Libpng | 1.0.47 (including) | 1.0.47 (including) |
| Libpng | Libpng | 1.0.48 (including) | 1.0.48 (including) |
| Libpng | Libpng | 1.0.50 (including) | 1.0.50 (including) |
| Libpng | Libpng | 1.0.51 (including) | 1.0.51 (including) |
| Libpng | Libpng | 1.0.52 (including) | 1.0.52 (including) |
| Libpng | Libpng | 1.0.53 (including) | 1.0.53 (including) |
| Libpng | Libpng | 1.0.54 (including) | 1.0.54 (including) |
| Libpng | Libpng | 1.0.55 (including) | 1.0.55 (including) |
| Libpng | Libpng | 1.0.56 (including) | 1.0.56 (including) |
| Libpng | Libpng | 1.0.57 (including) | 1.0.57 (including) |
| Libpng | Libpng | 1.0.58 (including) | 1.0.58 (including) |
| Libpng | Libpng | 1.0.59 (including) | 1.0.59 (including) |
| Libpng | Libpng | 1.0.60 (including) | 1.0.60 (including) |
| Libpng | Libpng | 1.0.61 (including) | 1.0.61 (including) |
| Libpng | Libpng | 1.0.62 (including) | 1.0.62 (including) |
| Libpng | Libpng | 1.0.63 (including) | 1.0.63 (including) |
| Libpng | Libpng | 1.0.64 (including) | 1.0.64 (including) |
| Libpng | Libpng | 1.0.65 (including) | 1.0.65 (including) |
| Libpng | Libpng | 1.0.66 (including) | 1.0.66 (including) |
| Libpng | Ubuntu | esm-infra-legacy/trusty | * |
| Libpng | Ubuntu | esm-infra/xenial | * |
| Libpng | Ubuntu | precise | * |
| Libpng | Ubuntu | trusty | * |
| Libpng | Ubuntu | trusty/esm | * |
| Libpng | Ubuntu | vivid/stable-phone-overlay | * |
| Libpng | Ubuntu | vivid/ubuntu-core | * |
| Libpng | Ubuntu | xenial | * |
| Libpng1.6 | Ubuntu | esm-apps/xenial | * |
| Libpng1.6 | Ubuntu | upstream | * |
| Libpng1.6 | Ubuntu | xenial | * |
| Libpng1.6 | Ubuntu | yakkety | * |
Potential Mitigations
References
- http://www.openwall.com/lists/oss-security/2016/12/29/2
- http://www.openwall.com/lists/oss-security/2016/12/30/4
- http://www.securityfocus.com/bid/95157
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://security.gentoo.org/glsa/201701-74
- https://usn.ubuntu.com/3712-1/
- https://usn.ubuntu.com/3712-2/
- http://www.openwall.com/lists/oss-security/2016/12/29/2
- http://www.openwall.com/lists/oss-security/2016/12/30/4
- http://www.securityfocus.com/bid/95157
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://security.gentoo.org/glsa/201701-74
- https://usn.ubuntu.com/3712-1/
- https://usn.ubuntu.com/3712-2/