CVE-2008-5907

Publication date 15 January 2009

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

The png_check_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory location to zero via vectors involving creation of crafted PNG files with keywords, related to an implicit cast of the '\0' character constant to a NULL pointer. NOTE: some sources incorrectly report this as a double free vulnerability.

Read the notes from the security team

Status

Package Ubuntu Release Status
libpng 8.10 intrepid
Fixed 1.2.27-1ubuntu0.1
8.04 LTS hardy
Fixed 1.2.15~beta5-3ubuntu0.1
7.10 gutsy
Fixed 1.2.15~beta5-2ubuntu0.2
6.06 LTS dapper
Fixed 1.2.8rel-5ubuntu0.4

Notes

mdeslaur

This may not be a security issue, as it seems it's when writing png see: http://openwall.com/lists/oss-security/2009/01/09/1

References

Related Ubuntu Security Notices (USN)

    • USN-730-1
    • libpng vulnerabilities
    • 6 March 2009

Other references