1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Home
  2. Security
  3. Security Lab
  4. Latest Threats
  5. Vulnerability Descriptions
  6. SA31781

libpng "png_push_read_zTXt()" Off-By-One Vulnerability

Report ID: SA31781
Source: Secunia
Date of Discovery: 08.09.2008
Criticality: Low
Affects:
libpng 1.x
Compromise From: From remote
Compromise Type: DoS

Summary

A vulnerability has been reported in libpng, which can be exploited by malicious people to cause a DoS (Denial of Service).

Detailed Description

A vulnerability has been reported in libpng, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an off-by-one error within the "png_push_read_zTXt()" function in pngread.c when processing malicious PNG images with specially crafted zTXt chunks, which can be exploited to crash an application using the library.

The vulnerability was reportedly introduced in version 1.2.30beta04 and is reported in version 1.2.31. Other versions may also be affected.

Note: An off-by-one error in pngtest.c was also fixed.

Solution

Fixed in version 1.2.32beta01.