CVE-2016-10087

Published: 30 January 2017

The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.

Notes

Author	Note
ratliff	"has existed in libpng since version 0.71 of June 26, 1995"
chrisccoulson	Looks like this code is #ifdef'd out of Firefox and Thunderbirdhidden because it's behind a PNG_TEXT_SUPPORTED define, which isn't enabled

Priority

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package	Release	Status
chromium-browser Launchpad, Ubuntu, Debian	artful	Not vulnerable (uses system libpng)
	bionic	Not vulnerable (uses system libpng)
	cosmic	Not vulnerable (uses system libpng)
	disco	Not vulnerable (uses system libpng)
	eoan	Not vulnerable (uses system libpng)
	focal	Not vulnerable (uses system libpng)
	groovy	Not vulnerable (uses system libpng)
	hirsute	Not vulnerable (uses system libpng)
	impish	Not vulnerable (uses system libpng)
	jammy	Not vulnerable (uses system libpng)
	kinetic	Not vulnerable (uses system libpng)
	lunar	Not vulnerable (uses system libpng)
	mantic	Not vulnerable (uses system libpng)
	precise	Not vulnerable (uses system libpng)
	trusty	Does not exist (trusty was not-affected [uses system libpng])
	upstream	Needs triage
	xenial	Not vulnerable (uses system libpng)
	yakkety	Not vulnerable (uses system libpng)
	zesty	Not vulnerable (uses system libpng)
firefox Launchpad, Ubuntu, Debian	artful	Not vulnerable
	bionic	Not vulnerable
	cosmic	Not vulnerable
	disco	Not vulnerable
	eoan	Not vulnerable
	focal	Not vulnerable
	groovy	Not vulnerable
	hirsute	Not vulnerable
	impish	Not vulnerable
	jammy	Not vulnerable
	kinetic	Not vulnerable
	lunar	Not vulnerable
	mantic	Not vulnerable
	precise	Not vulnerable
	trusty	Does not exist (trusty was not-affected)
	upstream	Not vulnerable
	xenial	Not vulnerable
	yakkety	Not vulnerable
	zesty	Not vulnerable
libpng Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	cosmic	Does not exist
	disco	Does not exist
	eoan	Does not exist
	focal	Does not exist
	groovy	Does not exist
	hirsute	Does not exist
	impish	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	precise	Ignored (end of life)
	trusty	Released (1.2.50-1ubuntu2.14.04.3)
	upstream	Needs triage
	xenial	Released (1.2.54-1ubuntu1.1)
	yakkety	Does not exist
	zesty	Does not exist
libpng1.6 Launchpad, Ubuntu, Debian	artful	Not vulnerable (1.6.27-1)
	bionic	Not vulnerable (1.6.27-1)
	cosmic	Not vulnerable (1.6.27-1)
	disco	Not vulnerable (1.6.27-1)
	eoan	Not vulnerable (1.6.27-1)
	focal	Not vulnerable (1.6.27-1)
	groovy	Not vulnerable (1.6.27-1)
	hirsute	Not vulnerable (1.6.27-1)
	impish	Not vulnerable (1.6.27-1)
	jammy	Not vulnerable (1.6.27-1)
	kinetic	Not vulnerable (1.6.27-1)
	lunar	Not vulnerable (1.6.27-1)
	mantic	Not vulnerable (1.6.27-1)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (1.6.27-1)
	xenial	Needed
	yakkety	Ignored (end of life)
	zesty	Not vulnerable (1.6.27-1)
thunderbird Launchpad, Ubuntu, Debian	artful	Not vulnerable
	bionic	Not vulnerable
	cosmic	Not vulnerable
	disco	Not vulnerable
	eoan	Not vulnerable
	focal	Not vulnerable
	groovy	Not vulnerable
	hirsute	Not vulnerable
	impish	Not vulnerable
	jammy	Not vulnerable
	kinetic	Not vulnerable
	lunar	Not vulnerable
	mantic	Not vulnerable
	precise	Not vulnerable
	trusty	Does not exist (trusty was not-affected)
	upstream	Not vulnerable
	xenial	Not vulnerable
	yakkety	Not vulnerable
	zesty	Not vulnerable

Severity score breakdown

Parameter	Value
Base score	7.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849799

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›