Bug 958791 (CVE-2015-8540) - VUL-1: CVE-2015-8540: libpng: read underflow in libpng
Summary: VUL-1: CVE-2015-8540: libpng: read underflow in libpng
Status: RESOLVED FIXED
Alias: CVE-2015-8540
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Deadline: 2016-11-16
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:SUSE:CVE-2015-8540:4.0:(AV:N/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-11 15:42 UTC by Marcus Meissner
Modified: 2022-02-13 11:07 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2015-12-11 15:42:55 UTC
From: xiaoqixue_1  <xiaoqixue_1@163.com>
Subject: [oss-security] CVE request - read underflow in libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 (pngwutil.c)
Date: Thu, 10 Dec 2015 22:04:02 +0800 (CST)

there is a underflow read in png_check_keyword in pngwutil.c in libpng-1.2.54, which is found by XiaoQixue and ChenYu.

if the data of "key" is only ' ' (0x20), it will read a byte before the buffer in line 1288.

it also impacts libpng 1.2.55, 1.0.65, 1.4.18, and 1.5.25 .

the details as follows:
https://sourceforge.net/p/libpng/bugs/244/
Comment 1 Marcus Meissner 2015-12-11 15:46:58 UTC
from mitre

This says the problem was on a "1288 while (kp == ' ')" line but that
seems very confusing because that line doesn't appear to be present in
libpng-1.2.54 or any other version. As far as we can tell, the
unpatched code has

  while (*kp == ' ')

and the patched code has

  while (key_len && *kp == ' ')

See

  http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815b42ed/

Use CVE-2015-8540.

Any instance of "kp ==" instead of "*kp ==" would have been a
different type of problem but we don't think that problem ever
occurred.
Comment 2 Swamp Workflow Management 2015-12-11 23:01:03 UTC
bugbot adjusting priority
Comment 3 Petr Gajdos 2015-12-14 15:43:22 UTC
From: Glenn Randers-Pehrson
To: oss-security@lists.openwall.com

> unpatched code has
>
>   while (*kp == ' ')
>
> and the patched code has
>
>   while (key_len && *kp == ' ')
>

That's correct.  The bug tracker at SourceForge has an unpleasant effect
of removing asterisks, backticks, and whatnot from bug reports, thereby
making the reports very confusing.
Comment 4 Petr Gajdos 2015-12-14 15:44:56 UTC
From: Glenn Randers-Pehrson
To: oss-security@lists.openwall.com

The bug was introduced in libpng-0.90, was fixed in libpng-1.6.0, and will
be
fixed in libpng-1.0.66, 1.2.56, 1.4.19, and 1.5.26.
Comment 5 Bernhard Wiedemann 2016-10-20 12:01:32 UTC
This is an autogenerated message for OBS integration:
This bug (958791) was mentioned in
https://build.opensuse.org/request/show/436518 13.2 / libpng12
Comment 6 Petr Gajdos 2016-10-20 12:25:58 UTC
Fixed in:
13.2/libpng12
12sp1/libpng15
12/libpng12
11/libpng12-0
10sp3/libpng

libpng16 is not affected.
Comment 8 Swamp Workflow Management 2016-10-28 19:12:46 UTC
openSUSE-SU-2016:2672-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 958791
CVE References: CVE-2015-8540
Sources used:
openSUSE 13.2 (src):    libpng12-1.2.51-3.9.1
Comment 9 Swamp Workflow Management 2016-11-02 07:57:43 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-11-16.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63170
Comment 11 Swamp Workflow Management 2017-03-29 19:11:46 UTC
SUSE-SU-2017:0860-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1017646,958791
CVE References: CVE-2015-8540,CVE-2016-10087
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    libpng12-1.2.50-19.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libpng12-1.2.50-19.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    libpng12-1.2.50-19.1
SUSE Linux Enterprise Server 12-SP2 (src):    libpng12-1.2.50-19.1
SUSE Linux Enterprise Server 12-SP1 (src):    libpng12-1.2.50-19.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    libpng12-1.2.50-19.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    libpng12-1.2.50-19.1
Comment 12 Swamp Workflow Management 2017-03-31 16:14:45 UTC
SUSE-SU-2017:0901-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1017646,958791
CVE References: CVE-2015-8540,CVE-2016-10087
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    libpng12-0-1.2.31-5.43.1
SUSE Linux Enterprise Server 11-SP4 (src):    libpng12-0-1.2.31-5.43.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    libpng12-0-1.2.31-5.43.1
Comment 13 Swamp Workflow Management 2017-04-05 16:22:00 UTC
openSUSE-SU-2017:0942-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1017646,958791
CVE References: CVE-2015-8540,CVE-2016-10087
Sources used:
openSUSE Leap 42.2 (src):    libpng12-1.2.50-10.3.1
openSUSE Leap 42.1 (src):    libpng12-1.2.50-11.1
Comment 14 Swamp Workflow Management 2017-04-06 13:12:13 UTC
SUSE-SU-2017:0950-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1017646,958791
CVE References: CVE-2015-8540,CVE-2016-10087
Sources used:
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    libpng15-1.5.22-9.1
SUSE Linux Enterprise Server 12-SP2 (src):    libpng15-1.5.22-9.1
SUSE Linux Enterprise Server 12-SP1 (src):    libpng15-1.5.22-9.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    libpng15-1.5.22-9.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    libpng15-1.5.22-9.1
Comment 15 Swamp Workflow Management 2017-04-18 10:15:35 UTC
openSUSE-SU-2017:1037-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1017646,958791
CVE References: CVE-2015-8540,CVE-2016-10087
Sources used:
openSUSE Leap 42.2 (src):    libpng15-1.5.22-5.3.1
openSUSE Leap 42.1 (src):    libpng15-1.5.22-7.1
Comment 16 Marcus Meissner 2017-06-20 11:42:03 UTC
released