[Bug 1086514] New: CVE-2013-7353 Integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks()
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1086514
Bug ID: 1086514
Summary: CVE-2013-7353 Integer overflow leading to a heap-based
buffer overflow in png_set_unknown_chunks()
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: huzaifas(a)redhat.com
CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl,
fedora-mingw(a)lists.fedoraproject.org,
jkoncick(a)redhat.com, jkurik(a)redhat.com,
ktietz(a)redhat.com, lfarkas(a)lfarkas.org,
pfrields(a)redhat.com, phracek(a)redhat.com,
rjones(a)redhat.com
An integer overflow leading to a heap-based buffer overflow was found in the
png_set_unknown_chunks() API function of libpng. A attacker could create a
specially-crafated image file and render it with an application written to
explicitly call png_set_unknown_chunks() function, could cause libpng to crash
or execute arbitrary code with the permissions of the user running such an
application.
The vendor mentions that internal calls use safe values. These issues could
potentially affect applications that use the libpng API. Apparently no such
applications were identified.
Reference:
http://sourceforge.net/p/libpng/bugs/199/
http://seclists.org/oss-sec/2014/q2/83
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=70jisqeWxf&a=cc_unsubscribe
8 years, 2 months
[Bug 890087] CVE-2012-5668 freetype: NULL Pointer Dereference in
bdf_free_font (#37905)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=890087
Ján Rusnačko <jrusnack(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=low,public=20121215, |impact=low,public=20121215,
|reported=20121225,source=in |reported=20121225,source=in
|ternet,cvss2=4.3/AV:N/AC:M/ |ternet,cvss2=4.3/AV:N/AC:M/
|Au:N/C:N/I:N/A:P,rhel-5/fre |Au:N/C:N/I:N/A:P,rhel-5/fre
|etype=notaffected,rhel-6/fr |etype=notaffected,rhel-6/fr
|eetype=wontfix,fedora-all/f |eetype=wontfix,fedora-all/f
|reetype=affected,fedora-all |reetype=affected,fedora-all
|/mingw32-freetype=affected |/mingw32-freetype=affected,
| |cwe=CWE-476[auto]
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months
[Bug 1086516] New: CVE-2013-7354 Integer overflow leading to a heap-based buffer overflow in png_set_sPLT() and png_set_text_2()
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1086516
Bug ID: 1086516
Summary: CVE-2013-7354 Integer overflow leading to a heap-based
buffer overflow in png_set_sPLT() and png_set_text_2()
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: huzaifas(a)redhat.com
CC: drizt(a)land.ru, erik-fedora(a)vanpienbroek.nl,
fedora-mingw(a)lists.fedoraproject.org,
jkoncick(a)redhat.com, jkurik(a)redhat.com,
ktietz(a)redhat.com, lfarkas(a)lfarkas.org,
pfrields(a)redhat.com, phracek(a)redhat.com,
rjones(a)redhat.com
An integer overflow leading to a heap-based buffer overflow was found in the
png_set_sPLT() and png_set_text_2() API functions of libpng. A attacker could
create a specially-crafated image file and render it with an application
written to explicitly call png_set_sPLT() or png_set_text_2() function, could
cause libpng to crash or execute arbitrary code with the permissions of the
user running such an application.
The vendor mentions that internal calls use safe values. These issues could
potentially affect applications that use the libpng API. Apparently no such
applications were identified.
Reference:
http://sourceforge.net/p/libpng/bugs/199/
http://seclists.org/oss-sec/2014/q2/83
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=lqm7CkaJep&a=cc_unsubscribe
8 years, 2 months
[Bug 890094] CVE-2012-5670 freetype: Out-of-bounds write in
_bdf_parse_glyphs() (#37907)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=890094
Ján Rusnačko <jrusnack(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|21215,reported=20121231,sou |21215,reported=20121231,sou
|rce=internet,cvss2=6.8/AV:N |rce=internet,cvss2=6.8/AV:N
|/AC:M/Au:N/C:P/I:P/A:P,rhel |/AC:M/Au:N/C:P/I:P/A:P,rhel
|-5/freetype=notaffected,rhe |-5/freetype=notaffected,rhe
|l-6/freetype=notaffected,fe |l-6/freetype=notaffected,fe
|dora-all/freetype=notaffect |dora-all/freetype=notaffect
|ed,fedora-all/mingw32-freet |ed,fedora-all/mingw32-freet
|ype=notaffected |ype=notaffected,cwe=CWE-787
| |[auto]
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months
[Bug 724906] CVE-2011-0216 libxml2: Off-by-one error leading to
heap-based buffer overflow in encoding
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=724906
Ján Rusnačko <jrusnack(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=low,public=20110720, |impact=low,public=20110720,
|reported=20110721,source=cv |reported=20110721,source=cv
|e,cvss2=5.1/AV:N/AC:H/Au:N/ |e,cvss2=5.1/AV:N/AC:H/Au:N/
|C:P/I:P/A:P,fedora-all/libx |C:P/I:P/A:P,fedora-all/libx
|ml=notaffected,fedora-all/l |ml=notaffected,fedora-all/l
|ibxml2=affected,fedora-all/ |ibxml2=affected,fedora-all/
|mingw32-libxml2=affected,rh |mingw32-libxml2=affected,rh
|el-4/libxml2=affected,rhel- |el-4/libxml2=affected,rhel-
|5/libxml2=affected,rhel-6/l |5/libxml2=affected,rhel-6/l
|ibxml2=affected,rhel-6/ming |ibxml2=affected,rhel-6/ming
|w32-libxml2=affected |w32-libxml2=affected,cwe=CW
| |E-122[auto]
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months
[Bug 849693] CVE-2012-3509 libiberty: integer overflow, leading to
heap-buffer overflow by processing certain file headers via bfd binary
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=849693
Ján Rusnačko <jrusnack(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2012 |impact=moderate,public=2012
|0829,reported=20120820,sour |0829,reported=20120820,sour
|ce=distros,cvss2=6.8/AV:N/A |ce=distros,cvss2=6.8/AV:N/A
|C:M/Au:N/C:P/I:P/A:P,rhel-5 |C:M/Au:N/C:P/I:P/A:P,rhel-5
|/compat-gcc-295=notaffected |/compat-gcc-295=notaffected
|,rhel-5/compat-gcc-296=nota |,rhel-5/compat-gcc-296=nota
|ffected,rhel-5/compat-gcc-3 |ffected,rhel-5/compat-gcc-3
|2=notaffected,rhel-5/compat |2=notaffected,rhel-5/compat
|-gcc-34=notaffected,rhel-5/ |-gcc-34=notaffected,rhel-5/
|binutils=new,rhel-5/binutil |binutils=new,rhel-5/binutil
|s220=new,rhel-5/gcc=notaffe |s220=new,rhel-5/gcc=notaffe
|cted,rhel-5/gcc44=notaffect |cted,rhel-5/gcc44=notaffect
|ed,rhel-5/gdb=notaffected,r |ed,rhel-5/gdb=notaffected,r
|hel-5/crash=new,rhel-6/comp |hel-5/crash=new,rhel-6/comp
|at-gcc-295=notaffected,rhel |at-gcc-295=notaffected,rhel
|-6/compat-gcc-296=notaffect |-6/compat-gcc-296=notaffect
|ed,rhel-6/compat-gcc-32=not |ed,rhel-6/compat-gcc-32=not
|affected,rhel-6/compat-gcc- |affected,rhel-6/compat-gcc-
|34=notaffected,rhel-6/gcc=n |34=notaffected,rhel-6/gcc=n
|otaffected,rhel-6/gdb=notaf |otaffected,rhel-6/gdb=notaf
|fected,rhel-6/crash=new,rhe |fected,rhel-6/crash=new,rhe
|l-6/binutils=new,rhel-6/min |l-6/binutils=new,rhel-6/min
|gw32-binutils=new,rhel-6/mi |gw32-binutils=new,rhel-6/mi
|ngw32-gcc=notaffected,fedor |ngw32-gcc=notaffected,fedor
|a-all/gcc=notaffected,fedor |a-all/gcc=notaffected,fedor
|a-all/crash=new,fedora-all/ |a-all/crash=new,fedora-all/
|gdb=notaffected,fedora-all/ |gdb=notaffected,fedora-all/
|binutils=new,fedora-all/com |binutils=new,fedora-all/com
|pat-gcc-296=notaffected,fed |pat-gcc-296=notaffected,fed
|ora-all/compat-gcc-32=notaf |ora-all/compat-gcc-32=notaf
|fected,fedora-all/compat-gc |fected,fedora-all/compat-gc
|c-34=notaffected,fedora-16/ |c-34=notaffected,fedora-16/
|mingw32-gcc=notaffected,epe |mingw32-gcc=notaffected,epe
|l-5/mingw32-gcc=notaffected |l-5/mingw32-gcc=notaffected
|,fedora-16/mingw32-binutils |,fedora-16/mingw32-binutils
|=new,epel-5/mingw32-binutil |=new,epel-5/mingw32-binutil
|s=new,fedora-all/insight=ne |s=new,fedora-all/insight=ne
|w,epel-5/insight=new,fedora |w,epel-5/insight=new,fedora
|-all/mono-debugger=new,fedo |-all/mono-debugger=new,fedo
|ra-all/mutrace=new,fedora-a |ra-all/mutrace=new,fedora-a
|ll/arm-gp2x-linux-binutils= |ll/arm-gp2x-linux-binutils=
|new,fedora-all/avr-binutils |new,fedora-all/avr-binutils
|=new,epel-6/avr-binutils=ne |=new,epel-6/avr-binutils=ne
|w,fedora-all/avr-gdb=new,ep |w,fedora-all/avr-gdb=new,ep
|el-6/avr-gdb=new,fedora-raw |el-6/avr-gdb=new,fedora-raw
|hide/binutils=affected |hide/binutils=affected,cwe=
| |CWE-190->CWE-122[auto]
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months
[Bug 1124500] CVE-2014-5116 cairo: NULL pointer dereference in
cairo_image_surface_get_data()
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1124500
Ján Rusnačko <jrusnack(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard| |
|impact=low,public=20140214, |impact=low,public=20140214,
|reported=20140729,source=cv |reported=20140729,source=cv
|e,cvss2=1.2/AV:L/AC:H/Au:N/ |e,cvss2=1.2/AV:L/AC:H/Au:N/
|C:N/I:N/A:P,rhel-5/cairo=ne |C:N/I:N/A:P,rhel-5/cairo=ne
|w,rhel-6/cairo=new,rhel-7/c |w,rhel-6/cairo=new,rhel-7/c
|airo=new,fedora-all/cairo=n |airo=new,fedora-all/cairo=n
|ew,rhev-m-3/mingw-virt-view |ew,rhev-m-3/mingw-virt-view
|er=new,fedora-all/mingw-cai |er=new,fedora-all/mingw-cai
|ro=new,epel-5/mingw32-cairo |ro=new,epel-5/mingw32-cairo
|=new,epel-7/mingw-cairo=new |=new,epel-7/mingw-cairo=new
| |,cwe=CWE-476[auto]
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months
[Bug 835863] CVE-2012-2807 libxml2 (64-bit): Multiple integer
overflows, leading to DoS or possibly other unspecified impact
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=835863
Ján Rusnačko <jrusnack(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2012 |impact=moderate,public=2012
|0626,reported=20120627,sour |0626,reported=20120627,sour
|ce=cve,cvss2=5.1/AV:N/AC:H/ |ce=cve,cvss2=5.1/AV:N/AC:H/
|Au:N/C:P/I:P/A:P,rhel-5/lib |Au:N/C:P/I:P/A:P,rhel-5/lib
|xml2=affected,rhel-6/libxml |xml2=affected,rhel-6/libxml
|2=affected,openshift-1/libx |2=affected,openshift-1/libx
|ml2=notaffected,fedora-all/ |ml2=notaffected,fedora-all/
|libxml2=affected,fedora-all |libxml2=affected,fedora-all
|/libxml=notaffected,rhel-6/ |/libxml=notaffected,rhel-6/
|mingw32-libxml2=notaffected |mingw32-libxml2=notaffected
|,epel-5/mingw32-libxml2=aff |,epel-5/mingw32-libxml2=aff
|ected,fedora-all/mingw32-li |ected,fedora-all/mingw32-li
|bxml2=affected |bxml2=affected,cwe=CWE-190[
| |auto]
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months