Libpng "png_set_rgb_to_gray()" Transform Buffer Overflow Vulnerability

Risk: Medium
Local: No
Remote: Yes
CWE: CWE-189

Ogólna skala CVSS: 6.8/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

libpng-1.5.0 is available from and from There are no changes from libpng-1.5.0rc07, except for fixing a couple of tiny typos in the manual. Read the ANNOUNCE file and the section on libpng-1.4 to 1.5 differences in libpng-manual.txt that come with libpng to see the differences from 1.4.5. The major changes include moving the png and png_info structs into their own private header files, and provision of a new, more thorough test program (pngvalid.c), and an awk-based system of maintaining the new pnglibconf.h file that keeps track of how libpng was configured (i.e., what features were supported when libpng was built). Most of this work was done by John Bowler. Except for the accessibility of the png and png_info structs (which we have been deprecating for more than a decade), the API isn't significantly changed. Applications built with libpng14 without compiler warnings about using deprecated features should also build without modification with libpng15. Please reply to the png-mng-implement list. Glenn


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021,


Back to Top