Status of CVE-2015-8126: libpng buffer overflow in png_set_PLTE

[Glenn Randers-Pehrson <glennrp () gmail com>]

On Thu, Nov 12, 2015 at 1:26 PM, Glenn Randers-Pehrson <glennrp () gmail com>
wrote:

> I request a CVE for a vulnerability in libpng, all versions, in the
> png_set_PLTE/png_get_PLTE functions.  These functions failed to check for
> an out-of-range palette when reading or writing PNG files with a bit_depth
> less than 8.  Some applications might read the bit depth from the IHDR
> chunk and allocate memory for a 2^N entry palette, while libpng can return
> a palette with up to 256 entries even when the bit depth is less than 8.
>
> libpng versions 1.6.19, 1.5.24, 1.4.17, 1.2.54, and 1.0.64 were released
> today (12 November 2015) to fix this vulnerability.  See
> libpng.sourceforge.net

The patch was incomplete.  While it defended against the potential overrun
while reading PNG files, it did not detect a potential overrun by
applications using png_set_PLTE directly.  Libpng versions 1.6.20, 1.5.25,
1.4.18, 1.2.55, and 1.0.65 which were released today, December 3, 2015, fix
this remaining problem.

The PNG Development Group has not yet been made aware of any application
that is actually vulnerable to CVE-2015-8126. The original "crash" obtained
by fuzzing optipng had triggered an assert() that probably should have been
a warning; no out-of-bounds read occurs in optipng.

Regards

Glenn Randers-Pehrson
libpng custodian