CVE-2014-9495 Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary...
HighCVSS 10.0
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libpng1.6(Debian:12) | < 1.6.16-1 | 1.6.16-1 |
| debian/libpng1.6(Debian:13) | < 1.6.16-1 | 1.6.16-1 |
| debian/libpng1.6(Debian:14) | < 1.6.16-1 | 1.6.16-1 |
| debian/texlive-bin(Debian:12) | < 2014.20140926.35254-4 | 2014.20140926.35254-4 |
| debian/texlive-bin(Debian:13) | < 2014.20140926.35254-4 | 2014.20140926.35254-4 |
| debian/texlive-bin(Debian:14) | < 2014.20140926.35254-4 | 2014.20140926.35254-4 |
| apple mac os x | <= 10.11.3 | No fix listed |
| libpng | <= 1.5.20 | No fix listed |
| libpng | = 1.6.0 | No fix listed |
| libpng | = 1.6.0-beta | No fix listed |
| libpng | = 1.6.1 | No fix listed |
| libpng | = 1.6.1-beta | No fix listed |
| libpng | = 1.6.2 | No fix listed |
| libpng | = 1.6.2-beta | No fix listed |
| libpng | = 1.6.3 | No fix listed |
| libpng | = 1.6.3-beta | No fix listed |
| libpng | = 1.6.4 | No fix listed |
| libpng | = 1.6.4-beta | No fix listed |
| libpng | = 1.6.5 | No fix listed |
| libpng | = 1.6.6 | No fix listed |
| libpng | = 1.6.7 | No fix listed |
| libpng | = 1.6.7-beta | No fix listed |
| libpng | = 1.6.8 | No fix listed |
| libpng | = 1.6.8-beta | No fix listed |
| libpng | = 1.6.9 | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| libpng | = 1.6.9-beta | No fix listed |
| libpng | = 1.6.10 | No fix listed |
| libpng | = 1.6.10-beta | No fix listed |
| libpng | = 1.6.11 | No fix listed |
| libpng | = 1.6.11-beta | No fix listed |
| libpng | = 1.6.12-beta | No fix listed |
| libpng | = 1.6.13 | No fix listed |
| libpng | = 1.6.13-beta | No fix listed |
| libpng | = 1.6.14 | No fix listed |
| libpng | = 1.6.14-beta | No fix listed |
| libpng | = 1.6.15 | No fix listed |
| libpng | = 1.6.15-beta | No fix listed |
References
- Debian Security Tracker CVE-2014-9495 vendor-advisory
- APPLE-SA-2016-03-21-5 vendor-advisory
- 62725 third-party-advisory
- [png-mng-implement] 20141221 Re: libpng-1.5.21rc02 and 1.6.16rc02 are available mailing-list
- [png-mng-announce] 20141222 libpng-1.5.21 and 1.6.16 are available mailing-list
- [oss-security] 20150103 Re: CVE Request: libpng 1.6.15 Heap Overflow mailing-list
- [oss-security] 20150109 Re: CVE Request: libpng 1.6.15 Heap Overflow mailing-list
- [oss-security] 20150110 Re: CVE Request: libpng 1.6.15 Heap Overflow mailing-list
- www.oracle.com
- 71820 vdb-entry
- 1031444 vdb-entry
- support.apple.com vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking