CVE-2015-8126
UnknownEPSS 10.34%
Last modified
CVE-2015-8126 is a vulnerability of currently unknown severity. Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.. EPSS estimates a 10.34% chance of exploitation in the next 30 days.
Description
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Libpng | Libpng | < 1.0.64 | — |
| Libpng | Libpng | >= 1.1.1, < 1.2.54 | — |
| Libpng | Libpng | >= 1.3.0, < 1.4.17 | — |
| Libpng | Libpng | >= 1.5.0, < 1.5.24 | — |
| Libpng | Libpng | >= 1.6.0, < 1.6.19 | — |
| Fedoraproject | Fedora | 21 | — |
| Fedoraproject | Fedora | 22 | — |
| Fedoraproject | Fedora | 23 | — |
| Opensuse | Leap | 42.1 | — |
| Opensuse | Opensuse | 13.1 | — |
| Opensuse | Opensuse | 13.2 | — |
| Suse | Linux Enterprise Desktop | 11 | Sp3 |
| Suse | Linux Enterprise Desktop | 12 | — |
| Suse | Linux Enterprise Server | 12 | — |
| Debian | Debian Linux | 7.0 | — |
| Debian | Debian Linux | 8.0 | — |
| Debian | Debian Linux | 9.0 | — |
| Redhat | Satellite | 5.7 | — |
| Redhat | Enterprise Linux Desktop | 6.0 | — |
| Redhat | Enterprise Linux Desktop | 7.0 | — |
| Redhat | Enterprise Linux Eus | 6.7 | — |
| Redhat | Enterprise Linux Eus | 7.2 | — |
| Redhat | Enterprise Linux Eus | 7.3 | — |
| Redhat | Enterprise Linux Eus | 7.4 | — |
| Redhat | Enterprise Linux Eus | 7.5 | — |
| Redhat | Enterprise Linux Eus | 7.6 | — |
| Redhat | Enterprise Linux Eus | 7.7 | — |
| Redhat | Enterprise Linux Server | 6.0 | — |
| Redhat | Enterprise Linux Server | 7.0 | — |
| Redhat | Enterprise Linux Server Aus | 7.2 | — |
| Redhat | Enterprise Linux Server Aus | 7.3 | — |
| Redhat | Enterprise Linux Server Aus | 7.4 | — |
| Redhat | Enterprise Linux Server Aus | 7.6 | — |
| Redhat | Enterprise Linux Server Aus | 7.7 | — |
| Redhat | Enterprise Linux Server Tus | 7.2 | — |
| Redhat | Enterprise Linux Server Tus | 7.3 | — |
| Redhat | Enterprise Linux Server Tus | 7.6 | — |
| Redhat | Enterprise Linux Server Tus | 7.7 | — |
| Redhat | Enterprise Linux Workstation | 6.0 | — |
| Redhat | Enterprise Linux Workstation | 7.0 | — |
| Redhat | Satellite | 5.6 | — |
| Oracle | Jdk | 1.6.0 | Update105 |
| Oracle | Jdk | 1.7.0 | Update91 |
| Oracle | Jdk | 1.8.0 | Update65 |
| Oracle | Jre | 1.6.0 | Update105 |
| Oracle | Jre | 1.7.0 | Update91 |
| Oracle | Jre | 1.8.0 | Update65 |
| Oracle | Linux | 6 | — |
| Oracle | Linux | 7 | — |
| Oracle | Solaris | 11.3 | — |
Showing 50 of 55 affected configurations. See NVD for the full list.
References
- http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.htmlThird Party Advisory
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00062.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00063.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00028.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00029.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00030.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-2594.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-2595.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-2596.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0055.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0056.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0057.htmlThird Party Advisory
- http://www.debian.org/security/2015/dsa-3399Third Party Advisory
- http://www.debian.org/security/2016/dsa-3507Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/11/12/2Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlThird Party Advisory
- http://www.securityfocus.com/bid/77568Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034142Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2815-1Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1430Third Party Advisory
- https://code.google.com/p/chromium/issues/detail?id=560291Issue Tracking, Patch, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10148Third Party Advisory
- https://security.gentoo.org/glsa/201603-09Third Party Advisory
- https://security.gentoo.org/glsa/201611-08Third Party Advisory
- https://support.apple.com/HT206167Third Party Advisory
- http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.htmlThird Party Advisory
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00062.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00063.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00028.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00029.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00030.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-2594.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-2595.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-2596.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0055.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0056.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0057.htmlThird Party Advisory
- http://www.debian.org/security/2015/dsa-3399Third Party Advisory
- http://www.debian.org/security/2016/dsa-3507Third Party Advisory
- http://www.openwall.com/lists/oss-security/2015/11/12/2Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlThird Party Advisory
- http://www.securityfocus.com/bid/77568Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034142Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2815-1Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1430Third Party Advisory
- https://code.google.com/p/chromium/issues/detail?id=560291Issue Tracking, Patch, Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10148Third Party Advisory
- https://security.gentoo.org/glsa/201603-09Third Party Advisory
- https://security.gentoo.org/glsa/201611-08Third Party Advisory
- https://support.apple.com/HT206167Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-8126?
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
How severe is CVE-2015-8126?
Severity scoring for CVE-2015-8126 is pending analysis. The EPSS model estimates a 10.34% probability of exploitation in the next 30 days.
How do I fix CVE-2015-8126?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2015-8126?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST