Skip to main content

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2015-8126

High
7.3/10

Summary

Multiple buffer overflows in the "png_set_PLTE" and "png_get_PLTE" functions in libpng through 1.0.63, 1.2.0beta1 through 1.2.54rc04, 1.3.0 through 1.4.17rc03, 1.5.0beta01 through 1.5.24rc02, 1.6.0alpha01 through 1.6.19rc03, 1.7.0alpha01 through 1.7.0beta67 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. This issue affects Chrome prior to version 49.0.2623.75.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • LOW

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

Advisory Timeline

  • Published