Package: libpng Version: 1.2.42-2 Severity: serious Tags: security http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0205 https://www.kb.cert.org/vuls/id/576029
libpng stalls on highly compressed ancillary chunks Libpng stalls and consumes large quantities of memory while processing certain Portable Network Graphics (PNG) files. When processing PNG files containing highly compressed ancillary chunks, the png_decompress_chunk() function in libpng can consume large amounts of CPU time and memory. This resource consumption may hang applications that use libpng. More information is available in the PNG Development Group security advisory and supplementary document, Defending Libpng Applications Against Decompression Bombs. This vulnerability could allow an unauthenticated, remote attacker to cause a denial of service. http://libpng.sourceforge.net/decompression_bombs.html Libpng provides functions to limit memory consumption and number of cached ancillary chunks. Applications that use libpng should use these functions to set appropriate limits. Please see defense #2 in the document Defending Libpng Applications Against Decompression Bombs (see web page above) for more information. Developers who build versions of libpng can choose to ignore ancillary chunks by defining specific preprocessor macros. Please see defense #3 in the document Defending Libpng Applications Against Decompression Bombs (see web page above) for more information.
signature.asc
Description: Digital signature
