crítica
CVE-2017-12652
libpng: does not check length of chunks against user limit
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat3.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Azure Linux, Photon OS. Más baja según Red Hat (baja), Amazon (baja), Oracle (baja), Ubuntu (baja).
Descripción
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | fltk | 0:1.3.8-1.azl3 |
| Photon OS 1.0 | libpng | 1.6.35-1.ph1 |
| Photon OS 2.0 | libpng | 1.6.35-1.ph2 |
| Photon OS 3.0 | syslinux | 6.04-8.ph3 |
| Photon OS 4.0 | syslinux, syslinux-devel | 6.04-9.ph4 |
| Photon OS 5.0 | syslinux, syslinux-devel | 6.04-10.ph5 |
| amazon linux 2 | libpng, libpng-debuginfo, libpng-devel y 1 más | 2:1.5.13-8.amzn2 |
| debian 11 | libpng1.6 | 1.6.32-1 |
| debian 12 | libpng1.6 | 1.6.32-1 |
| debian 13 | libpng1.6 | 1.6.32-1 |
| debian 14 | libpng1.6 | 1.6.32-1 |
| debian 9 | libpng1.6 | sin corrección indicada |
Mostrar las 29 entradas de 19 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| Azure Linux 3.0 | fltk | 0:1.3.8-1.azl3 |
| Photon OS 1.0 | libpng | 1.6.35-1.ph1 |
| Photon OS 2.0 | libpng | 1.6.35-1.ph2 |
| Photon OS 3.0 | syslinux | 6.04-8.ph3 |
| Photon OS 4.0 | syslinux | 6.04-9.ph4 |
| Photon OS 4.0 | syslinux-devel | 6.04-9.ph4 |
| Photon OS 5.0 | syslinux | 6.04-10.ph5 |
| Photon OS 5.0 | syslinux-devel | 6.04-10.ph5 |
| amazon linux 2 | libpng | 2:1.5.13-8.amzn2 |
| amazon linux 2 | libpng-debuginfo | 2:1.5.13-8.amzn2 |
| amazon linux 2 | libpng-devel | 2:1.5.13-8.amzn2 |
| amazon linux 2 | libpng-static | 2:1.5.13-8.amzn2 |
| debian 11 | libpng1.6 | 1.6.32-1 |
| debian 12 | libpng1.6 | 1.6.32-1 |
| debian 13 | libpng1.6 | 1.6.32-1 |
| debian 14 | libpng1.6 | 1.6.32-1 |
| debian 9 | libpng1.6 | sin corrección indicada |
| echo | libpng1.6 | 1.6.32-1 |
| Oracle Linux 7 | libpng | 2:1.5.13-8.el7 |
| Oracle Linux 7 | libpng-devel | 2:1.5.13-8.el7 |
| Oracle Linux 7 | libpng-static | 2:1.5.13-8.el7 |
| Red Hat | libpng | sin corrección indicada |
| Red Hat | libpng-devel | sin corrección indicada |
| Red Hat | libpng-static | sin corrección indicada |
| root.io debian 11 | rootio-libpng1.6 | 1.6.32-1 |
| root.io debian 12 | rootio-libpng1.6 | 1.6.32-1 |
| root.io debian 13 | rootio-libpng1.6 | 1.6.32-1 |
| ubuntu 16.04-ESM | libpng | 1.2.54-1ubuntu1.1+esm1 |
| ubuntu 16.04-ESM | libpng1.6 | 1.6.20-2ubuntu0.1~esm1 |
Referencias
- http://www.securityfocus.com/bid/109269
- https://access.redhat.com/security/cve/CVE-2017-12652
- https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE
- https://github.com/pnggroup/libpng/commit/347538efbdc21b8df684ebd92d37400b3ce85d55
- https://linux.oracle.com/cve/CVE-2017-12652.html
- https://linux.oracle.com/errata/ELSA-2020-3901.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-12652
- https://security.netapp.com/advisory/ntap-20220506-0003/
Las 14 referencias
- https://support.f5.com/csp/article/K88124225
- https://support.f5.com/csp/article/K88124225?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K88124225?utm_source=f5support&utm_medium=RSS
- https://ubuntu.com/security/notices/USN-5432-1
- https://ubuntu.com/security/notices/USN-5432-2
- https://www.cve.org/CVERecord?id=CVE-2017-12652