CVE-2006-5793
Fixed in a distro release EPSS 2%
The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.
Products: greg_roelofs libpng
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 2.1 | libpng | 2:1.0.14-10 |
| Red Hat Enterprise Linux 2.1 | libpng-devel | 2:1.0.14-10 |
| Red Hat Enterprise Linux 3 | libpng | 2:1.2.2-27 |
| Red Hat Enterprise Linux 3 | libpng-debuginfo | 2:1.2.2-27 |
| Red Hat Enterprise Linux 3 | libpng-devel | 2:1.2.2-27 |
| Red Hat Enterprise Linux 3 | libpng10 | 0:1.0.13-17 |
| Red Hat Enterprise Linux 3 | libpng10-debuginfo | 0:1.0.13-17 |
| Red Hat Enterprise Linux 3 | libpng10-devel | 0:1.0.13-17 |
| Red Hat Enterprise Linux 4 | libpng | 2:1.2.7-3.el4 |
| Red Hat Enterprise Linux 4 | libpng-debuginfo | 2:1.2.7-3.el4 |
| Red Hat Enterprise Linux 4 | libpng-devel | 2:1.2.7-3.el4 |
| Red Hat Enterprise Linux 4 | libpng10 | 0:1.0.16-3 |
| Red Hat Enterprise Linux 4 | libpng10-debuginfo | 0:1.0.16-3 |
| Red Hat Enterprise Linux 4 | libpng10-devel | 0:1.0.16-3 |
| Red Hat Enterprise Linux 5 | libpng | 2:1.2.10-7.0.2 |
| Red Hat Enterprise Linux 5 | libpng-debuginfo | 2:1.2.10-7.0.2 |
| Red Hat Enterprise Linux 5 | libpng-devel | 2:1.2.10-7.0.2 |
| openSUSE Tumbleweed | libpng16 | 1.6.37-3.3 |