critique
CVE-2017-12652
libpng: does not check length of chunks against user limit
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat3.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD, Azure Linux, Photon OS. Plus basse selon Red Hat (faible), Amazon (faible), Oracle (faible), Ubuntu (faible).
Description
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Azure Linux 3.0 | fltk | 0:1.3.8-1.azl3 |
| Photon OS 1.0 | libpng | 1.6.35-1.ph1 |
| Photon OS 2.0 | libpng | 1.6.35-1.ph2 |
| Photon OS 3.0 | syslinux | 6.04-8.ph3 |
| Photon OS 4.0 | syslinux, syslinux-devel | 6.04-9.ph4 |
| Photon OS 5.0 | syslinux, syslinux-devel | 6.04-10.ph5 |
| amazon linux 2 | libpng, libpng-debuginfo, libpng-devel et 1 autres | 2:1.5.13-8.amzn2 |
| debian 11 | libpng1.6 | 1.6.32-1 |
| debian 12 | libpng1.6 | 1.6.32-1 |
| debian 13 | libpng1.6 | 1.6.32-1 |
| debian 14 | libpng1.6 | 1.6.32-1 |
| debian 9 | libpng1.6 | pas de correctif indiqué |
Afficher les 29 entrées de 19 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Azure Linux 3.0 | fltk | 0:1.3.8-1.azl3 |
| Photon OS 1.0 | libpng | 1.6.35-1.ph1 |
| Photon OS 2.0 | libpng | 1.6.35-1.ph2 |
| Photon OS 3.0 | syslinux | 6.04-8.ph3 |
| Photon OS 4.0 | syslinux | 6.04-9.ph4 |
| Photon OS 4.0 | syslinux-devel | 6.04-9.ph4 |
| Photon OS 5.0 | syslinux | 6.04-10.ph5 |
| Photon OS 5.0 | syslinux-devel | 6.04-10.ph5 |
| amazon linux 2 | libpng | 2:1.5.13-8.amzn2 |
| amazon linux 2 | libpng-debuginfo | 2:1.5.13-8.amzn2 |
| amazon linux 2 | libpng-devel | 2:1.5.13-8.amzn2 |
| amazon linux 2 | libpng-static | 2:1.5.13-8.amzn2 |
| debian 11 | libpng1.6 | 1.6.32-1 |
| debian 12 | libpng1.6 | 1.6.32-1 |
| debian 13 | libpng1.6 | 1.6.32-1 |
| debian 14 | libpng1.6 | 1.6.32-1 |
| debian 9 | libpng1.6 | pas de correctif indiqué |
| echo | libpng1.6 | 1.6.32-1 |
| Oracle Linux 7 | libpng | 2:1.5.13-8.el7 |
| Oracle Linux 7 | libpng-devel | 2:1.5.13-8.el7 |
| Oracle Linux 7 | libpng-static | 2:1.5.13-8.el7 |
| Red Hat | libpng | pas de correctif indiqué |
| Red Hat | libpng-devel | pas de correctif indiqué |
| Red Hat | libpng-static | pas de correctif indiqué |
| root.io debian 11 | rootio-libpng1.6 | 1.6.32-1 |
| root.io debian 12 | rootio-libpng1.6 | 1.6.32-1 |
| root.io debian 13 | rootio-libpng1.6 | 1.6.32-1 |
| ubuntu 16.04-ESM | libpng | 1.2.54-1ubuntu1.1+esm1 |
| ubuntu 16.04-ESM | libpng1.6 | 1.6.20-2ubuntu0.1~esm1 |
Références
- http://www.securityfocus.com/bid/109269
- https://access.redhat.com/security/cve/CVE-2017-12652
- https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE
- https://github.com/pnggroup/libpng/commit/347538efbdc21b8df684ebd92d37400b3ce85d55
- https://linux.oracle.com/cve/CVE-2017-12652.html
- https://linux.oracle.com/errata/ELSA-2020-3901.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-12652
- https://security.netapp.com/advisory/ntap-20220506-0003/
Les 14 références
- https://support.f5.com/csp/article/K88124225
- https://support.f5.com/csp/article/K88124225?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K88124225?utm_source=f5support&utm_medium=RSS
- https://ubuntu.com/security/notices/USN-5432-1
- https://ubuntu.com/security/notices/USN-5432-2
- https://www.cve.org/CVERecord?id=CVE-2017-12652