7.5

CVE-2015-8126

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Data is provided by the National Vulnerability Database (NVD)
Libpng ≫ Libpng Version < 1.0.64
Libpng ≫ Libpng Version >= 1.1.1 < 1.2.54
Libpng ≫ Libpng Version >= 1.3.0 < 1.4.17
Libpng ≫ Libpng Version >= 1.5.0 < 1.5.24
Libpng ≫ Libpng Version >= 1.6.0 < 1.6.19
Fedoraproject ≫ Fedora Version21
Fedoraproject ≫ Fedora Version22
Fedoraproject ≫ Fedora Version23
Opensuse ≫ Leap Version42.1
Opensuse ≫ Opensuse Version13.1
Opensuse ≫ Opensuse Version13.2
Suse ≫ Linux Enterprise Desktop Version11 Updatesp3
Suse ≫ Linux Enterprise Desktop Version11 Updatesp4
Suse ≫ Linux Enterprise Desktop Version12 Update-
Suse ≫ Linux Enterprise Desktop Version12 Updatesp1
Suse ≫ Linux Enterprise Server Version12 Update-
Suse ≫ Linux Enterprise Server Version12 Updatesp1
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Redhat ≫ Satellite Version5.7
Redhat ≫ Enterprise Linux Eus Version6.7
Redhat ≫ Enterprise Linux Eus Version7.2
Redhat ≫ Enterprise Linux Eus Version7.3
Redhat ≫ Enterprise Linux Eus Version7.4
Redhat ≫ Enterprise Linux Eus Version7.5
Redhat ≫ Enterprise Linux Eus Version7.6
Redhat ≫ Enterprise Linux Eus Version7.7
Redhat ≫ Satellite Version5.6
   Redhat ≫ Enterprise Linux Version5.0
   Redhat ≫ Enterprise Linux Version6.0
Oracle ≫ Jdk Version1.6.0 Updateupdate105
Oracle ≫ Jdk Version1.7.0 Updateupdate91
Oracle ≫ Jdk Version1.8.0 Updateupdate65
Oracle ≫ Jdk Version1.8.0 Updateupdate66
Oracle ≫ Jre Version1.6.0 Updateupdate105
Oracle ≫ Jre Version1.7.0 Updateupdate91
Oracle ≫ Jre Version1.8.0 Updateupdate65
Oracle ≫ Jre Version1.8.0 Updateupdate66
Oracle ≫ Linux Version6 Update-
Oracle ≫ Linux Version7 Update-
Oracle ≫ Solaris Version11.3
Apple ≫ macOS X Version < 10.11.4
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version14.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version15.04
Canonical ≫ Ubuntu Linux Version15.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 4.95% 0.892
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

http://www.securityfocus.com/bid/77568
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034142
Third Party Advisory
VDB Entry
https://code.google.com/p/chromium/issues/detail?id=560291
Patch
Third Party Advisory
Issue Tracking