libpng: Remote execution of arbitrary code

最新推荐文章于 2021-05-24 23:55:03 发布

小老尚

最新推荐文章于 2021-05-24 23:55:03 发布

阅读量286

点赞数

CC 4.0 BY-SA版权

分类专栏： C & C++ 文章标签： libpng null-point max-text

本文链接：https://blog.youkuaiyun.com/peeno/article/details/79005191

C & C++ 专栏收录该内容

6 篇文章

订阅专栏

libpng中发现了一个空指针引用漏洞，在特定条件下可能导致远程攻击者执行任意代码。此漏洞存在于png_push_save_buffer函数中，受影响版本包括<1.6.27等。libpng-1.6.27及后续版本已修复该漏洞。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

A null pointer dereference in libpng might allow remote attackers to execute arbitrary code.

Affected Packages
Package media-libs/libpng on all architectures

content	version
Affected versions	< 1.6.27
Unaffected versions	>= 1.6.27 >= 1.5.28 >= 1.4.20 >= 1.2.57 >= 1.0.67

Background
libpng is a standard library used to process PNG (Portable Network Graphics) images. It is used by several programs, including web browsers and potentially server processes.

Description
A null pointer dereference was discovered in libpng in the png_push_save_buffer function. In order to be vulnerable, an application has to load a text chunk into the PNG structure, then delete all text, then add another text chunk to the same PNG structure, which seems to be an unlikely sequence, but it is possible.

Impact
A remote attacker, by enticing a user to process a specially crafted PNG file, could execute arbitrary code with the privileges of the process.

libpng-1.6.27 has been released to fix an old NULL pointer dereference
bug in png_set_text_2() discovered and patched by Patrick Keshishian.

New releases of legacy branches (1.0.67, 1.2.57, 1.4.20, and 1.5.28) have
also been released. Other versions can be patched by adding a single
line

  info_ptr->max_text = 0;

at the appropriate spot in png.c.

The potential “NULL dereference” bug that has existed in libpng
since version 0.71 of June 26, 1995. To be vulnerable, an application
has to load a text chunk into the png structure, then delete all text, then
add another text chunk to the same png structure, which seems to be
an unlikely sequence, but it has happened.

Applications that I have looked at (firefox, imagemagick, graphicsmagick,
pngcrush) do not appear to be vulnerable.

https://security.gentoo.org/glsa/201701-74
http://www.openwall.com/lists/oss-security/2016/12/29/2