Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

0

CVE-2015-8126

Disclosure Date: November 13, 2015 •

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

apple,
canonical,
debian,
fedoraproject,
libpng,
opensuse,
oracle,
redhat,
suse

Products

References

Canonical

CVE-2015-8126 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8126)

BID-77568 (http://www.securityfocus.com/bid/77568)

Advisory

APPLE-SA-2016-03-21-5 (http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html)

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00028.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.html

https://support.apple.com/HT206167

http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.html

http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html

FEDORA-2015-5e52306c9c (http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172324.html)

FEDORA-2015-ec2ddd15d7 (http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.html)

GLSA-201611-08 (https://security.gentoo.org/glsa/201611-08)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html

DSA-3507 (http://www.debian.org/security/2016/dsa-3507)

FEDORA-2015-501493d853 (http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.html)

SECTRACK-1034142 (http://www.securitytracker.com/id/1034142)

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

https://access.redhat.com/errata/RHSA-2016:1430

FEDORA-2015-1d87313b7c (http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.html)

DSA-3399 (http://www.debian.org/security/2015/dsa-3399)

http://rhn.redhat.com/errata/RHSA-2015-2595.html

http://rhn.redhat.com/errata/RHSA-2015-2596.html

http://lists.opensuse.org/opensuse-updates/2015-12/msg00062.html

FEDORA-2015-8a1243db75 (http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172823.html)

FEDORA-2015-13668fff74 (http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172769.html)

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html

https://kc.mcafee.com/corporate/index?page=content&id=SB10148

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.html

[oss-security] 20151112 CVE request: libpng buffer overflow in png_set_PLTE (http://www.openwall.com/lists/oss-security/2015/11/12/2)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00030.html

FEDORA-2015-97fc1797fa (http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172797.html)

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html

FEDORA-2016-43735c33a7 (http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177382.html)

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html

GLSA-201603-09 (https://security.gentoo.org/glsa/201603-09)

FEDORA-2016-9a1c707b10 (http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177344.html)

http://lists.opensuse.org/opensuse-updates/2015-12/msg00063.html

http://rhn.redhat.com/errata/RHSA-2016-0057.html

http://rhn.redhat.com/errata/RHSA-2016-0055.html

FEDORA-2015-c80ec85542 (http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.html)

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.html

USN-2815-1 (http://www.ubuntu.com/usn/USN-2815-1)

http://rhn.redhat.com/errata/RHSA-2016-0056.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html

FEDORA-2015-4ad4998d00 (http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.html)

http://rhn.redhat.com/errata/RHSA-2015-2594.html

FEDORA-2015-233750b6ab (http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.html)

https://code.google.com/p/chromium/issues/detail?id=560291

http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00029.html

Rapid7

Technical Analysis