CVE-2007-5266

NameCVE-2007-5266
DescriptionOff-by-one error in ICC profile chunk handling in the png_set_iCCP function in pngset.c in libpng before 1.0.29 beta1 and 1.2.x before 1.2.21 beta1 allows remote attackers to cause a denial of service (crash) via a crafted PNG image that prevents a name field from being NULL terminated.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libpng (PTS)jessie, jessie (lts)1.2.50-2+deb8u3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libpngsource(unstable)(not affected)

Notes

- libpng <not-affected> (vulnerable code not present)
the version in Debian does not use strncpy to copy the buffer so this off-by-one
is not present in this old version. Instead it allocates space for strlen(name)+1
and uses strcpy(new_iccp_name, name) which is not nice but safe

Search for package or bug name: Reporting problems