CVE:CVE-2008-1382
CNNVD:CNNVD-200804-177
libpng是多种应用程序所使用的解析PNG图形格式的函数库 。
libpng库在处理畸形格式的PNG文件时存在漏洞，成功利用此漏洞允许本地攻击者读取敏感信息、导致拒绝服务或执行任意指令 。
libpng库没有正确地处理未知类型的PNG块，如果使用该库的应用程序在特定情况下调用了png_set_read_user_chunk_fn()或png_set_keep_unknown_chunks()函数的话，长度为0的PNG块就会导致通过free()调用使用未初始化的内存 。
solution:Upgrade libpng libpng to a higher version than 1.0.6:a,1.0.6:d,1.0.6:e,1.0.6:f,1.0.6:g,1.0.6:h,1.0.6:i,1.0.6:j,1.0.7:beta11,1.0.7:beta12,1.0.7:beta13,1.0.7:beta14,1.0.7:beta15,1.0.7:beta16,1.0.7:beta17,1.0.7:beta18,1.0.7:rc1,1.0.7:rc2,1.0.8:beta1,1.0.8:beta2,1.0.8:beta3,1.0.8:beta4,1.0.8:rc1,1.0.9:beta1,1.0.9:beta10,1.0.9:beta2,1.0.9:beta3,1.0.9:beta4,1.0.9:beta5,1.0.9:beta6,1.0.9:beta7,1.0.9:beta8,1.0.9:beta9,1.0.9:rc1,1.0.9:rc2,1.0.10:beta1,1.0.10:rc1,1.0.11:beta1,1.0.11:beta2,1.0.11:beta3,1.0.11:rc1,1.0.12,1.0.12:beta1,1.0.12:rc1,1.0.13,1.0.14,1.0.15,1.0.15:rc1,1.0.15:rc2,1.0.15:rc3,1.0.16,1.0.17,1.0.18,1.0.19,1.0.19:rc1,1.0.19:rc2,1.0.19:rc3,1.0.19:rc5,1.0.20,1.0.21,1.0.21:rc1,1.0.21:rc2,1.0.22,1.0.22:rc1,1.0.23,1.0.23:rc1,1.0.23:rc2,1.0.23:rc3,1.0.23:rc4,1.0.23:rc5,1.0.24,1.0.24:rc1,1.0.25,1.0.25:rc1,1.0.25:rc2,1.0.26,1.0.27,1.0.27:rc1,1.0.27:rc2,1.0.27:rc3,1.0.27:rc4,1.0.27:rc5,1.0.27:rc6,1.0.28,1.0.28:rc2,1.0.28:rc3,1.0.28:rc4,1.0.28:rc5,1.0.28:rc6,1.0.29,1.0.29:beta1,1.0.29:rc1,1.0.29:rc2,1.0.29:rc3,1.0.30,1.0.30:rc1,1.0.31,1.0.31:rc01,1.0.32,1.2.0:beta1,1.2.0:beta2,1.2.0:beta3,1.2.0:beta4,1.2.0:beta5,1.2.0:rc1,1.2.1:beta1,1.2.1:beta2,1.2.1:beta3,1.2.1:beta4,1.2.1:rc1,1.2.1:rc2,1.2.2:beta1,1.2.2:beta2,1.2.2:beta3,1.2.2:beta4,1.2.2:beta5,1.2.2:beta6,1.2.2:rc1,1.2.3:rc1,1.2.3:rc2,1.2.3:rc3,1.2.3:rc4,1.2.3:rc5,1.2.3:rc6,1.2.4:beta1,1.2.4:beta2,1.2.4:beta3,1.2.4:rc1,1.2.5:beta1,1.2.5:beta2,1.2.5:rc1,1.2.5:rc2,1.2.5:rc3,1.2.6:beta1,1.2.6:beta2,1.2.6:beta3,1.2.6:beta4,1.2.6:rc1,1.2.6:rc2,1.2.6:rc3,1.2.6:rc4,1.2.6:rc5,1.2.7:beta1,1.2.7:beta2,1.2.8:beta1,1.2.8:beta2,1.2.8:beta3,1.2.8:beta4,1.2.8:beta5,1.2.8:rc1,1.2.8:rc2,1.2.8:rc3,1.2.8:rc4,1.2.8:rc5,1.2.9:beta1,1.2.9:beta10,1.2.9:beta2,1.2.9:beta3,1.2.9:beta4,1.2.9:beta5,1.2.9:beta6,1.2.9:beta7,1.2.9:beta8,1.2.9:beta9,1.2.9:rc1,1.2.10:beta1,1.2.10:beta2,1.2.10:beta3,1.2.10:beta4,1.2.10:beta5,1.2.10:beta6,1.2.10:beta7,1.2.10:rc1,1.2.10:rc2,1.2.10:rc3,1.2.11:beta1,1.2.11:beta2,1.2.11:beta3,1.2.11:beta4,1.2.11:rc1,1.2.11:rc2,1.2.11:rc3,1.2.11:rc5,1.2.13:beta1,1.2.13:rc1,1.2.13:rc2,1.2.14:beta1,1.2.14:beta2,1.2.14:rc1,1.2.15:beta1,1.2.15:beta2,1.2.15:beta3,1.2.15:beta4,1.2.15:beta5,1.2.15:beta6,1.2.15:rc1,1.2.15:rc2,1.2.15:rc3,1.2.15:rc4,1.2.15:rc5,1.2.16:beta1,1.2.16:beta2,1.2.16:rc1,1.2.17:beta1,1.2.17:beta2,1.2.17:rc1,1.2.17:rc2,1.2.17:rc3,1.2.17:rc4,1.2.19:beta1,1.2.19:beta10,1.2.19:beta11,1.2.19:beta12,1.2.19:beta13,1.2.19:beta14,1.2.19:beta15,1.2.19:beta16,1.2.19:beta17,1.2.19:beta18,1.2.19:beta19,1.2.19:beta2,1.2.19:beta20,1.2.19:beta21,1.2.19:beta22,1.2.19:beta23,1.2.19:beta24,1.2.19:beta25,1.2.19:beta26,1.2.19:beta27,1.2.19:beta28,1.2.19:beta29,1.2.19:beta3,1.2.19:beta30,1.2.19:beta31,1.2.19:beta4,1.2.19:beta5,1.2.19:beta6,1.2.19:beta7,1.2.19:beta8,1.2.19:beta9,1.2.19:rc1,1.2.19:rc2,1.2.19:rc3,1.2.19:rc4,1.2.19:rc5,1.2.19:rc6,1.2.20:beta01,1.2.20:beta02,1.2.20:beta03,1.2.20:beta04,1.2.20:rc1,1.2.20:rc2,1.2.20:rc3,1.2.20:rc4,1.2.20:rc5,1.2.20:rc6,1.2.21:rc3,1.2.22:beta1,1.2.22:beta2,1.2.22:beta2-1.2.21,1.2.22:beta3,1.2.22:beta3-1.2.21,1.2.22:beta4,1.2.22:beta4-1.2.21,1.2.22:rc1,1.2.22:rc1-1.2.21,1.2.23:beta01,1.2.23:beta02,1.2.23:beta03,1.2.23:beta04,1.2.23:beta05,1.2.23:rc01,1.2.24:beta01,1.2.24:beta02,1.2.24:beta03,1.2.24:rc01,1.2.25:beta01,1.2.25:beta02,1.2.25:beta03,1.2.25:beta04,1.2.25:beta05,1.2.25:beta06,1.2.25:rc01,1.2.25:rc02,1.2.26:beta01,1.2.26:beta02,1.2.26:beta03,1.2.26:beta04,1.2.26:beta05,1.2.26:beta06,1.2.26:rc01,1.4:beta1,1.4:beta10,1.4:beta11,1.4:beta12,1.4:beta13,1.4:beta14,1.4:beta15,1.4:beta16,1.4:beta17,1.4:beta18,1.4:beta19,1.4:beta2,1.4:beta3,1.4:beta4,1.4:beta5,1.4:beta6,1.4:beta7,1.4:beta8,1.4:beta9,and avoid the version 1.0.6:a,1.0.6:d,1.0.6:e,1.0.6:f,1.0.6:g,1.0.6:h,1.0.6:i,1.0.6:j,1.0.7:beta11,1.0.7:beta12,1.0.7:beta13,1.0.7:beta14,1.0.7:beta15,1.0.7:beta16,1.0.7:beta17,1.0.7:beta18,1.0.7:rc1,1.0.7:rc2,1.0.8:beta1,1.0.8:beta2,1.0.8:beta3,1.0.8:beta4,1.0.8:rc1,1.0.9:beta1,1.0.9:beta10,1.0.9:beta2,1.0.9:beta3,1.0.9:beta4,1.0.9:beta5,1.0.9:beta6,1.0.9:beta7,1.0.9:beta8,1.0.9:beta9,1.0.9:rc1,1.0.9:rc2,1.0.10:beta1,1.0.10:rc1,1.0.11:beta1,1.0.11:beta2,1.0.11:beta3,1.0.11:rc1,1.0.12,1.0.12:beta1,1.0.12:rc1,1.0.13,1.0.14,1.0.15,1.0.15:rc1,1.0.15:rc2,1.0.15:rc3,1.0.16,1.0.17,1.0.18,1.0.19,1.0.19:rc1,1.0.19:rc2,1.0.19:rc3,1.0.19:rc5,1.0.20,1.0.21,1.0.21:rc1,1.0.21:rc2,1.0.22,1.0.22:rc1,1.0.23,1.0.23:rc1,1.0.23:rc2,1.0.23:rc3,1.0.23:rc4,1.0.23:rc5,1.0.24,1.0.24:rc1,1.0.25,1.0.25:rc1,1.0.25:rc2,1.0.26,1.0.27,1.0.27:rc1,1.0.27:rc2,1.0.27:rc3,1.0.27:rc4,1.0.27:rc5,1.0.27:rc6,1.0.28,1.0.28:rc2,1.0.28:rc3,1.0.28:rc4,1.0.28:rc5,1.0.28:rc6,1.0.29,1.0.29:beta1,1.0.29:rc1,1.0.29:rc2,1.0.29:rc3,1.0.30,1.0.30:rc1,1.0.31,1.0.31:rc01,1.0.32,1.2.0:beta1,1.2.0:beta2,1.2.0:beta3,1.2.0:beta4,1.2.0:beta5,1.2.0:rc1,1.2.1:beta1,1.2.1:beta2,1.2.1:beta3,1.2.1:beta4,1.2.1:rc1,1.2.1:rc2,1.2.2:beta1,1.2.2:beta2,1.2.2:beta3,1.2.2:beta4,1.2.2:beta5,1.2.2:beta6,1.2.2:rc1,1.2.3:rc1,1.2.3:rc2,1.2.3:rc3,1.2.3:rc4,1.2.3:rc5,1.2.3:rc6,1.2.4:beta1,1.2.4:beta2,1.2.4:beta3,1.2.4:rc1,1.2.5:beta1,1.2.5:beta2,1.2.5:rc1,1.2.5:rc2,1.2.5:rc3,1.2.6:beta1,1.2.6:beta2,1.2.6:beta3,1.2.6:beta4,1.2.6:rc1,1.2.6:rc2,1.2.6:rc3,1.2.6:rc4,1.2.6:rc5,1.2.7:beta1,1.2.7:beta2,1.2.8:beta1,1.2.8:beta2,1.2.8:beta3,1.2.8:beta4,1.2.8:beta5,1.2.8:rc1,1.2.8:rc2,1.2.8:rc3,1.2.8:rc4,1.2.8:rc5,1.2.9:beta1,1.2.9:beta10,1.2.9:beta2,1.2.9:beta3,1.2.9:beta4,1.2.9:beta5,1.2.9:beta6,1.2.9:beta7,1.2.9:beta8,1.2.9:beta9,1.2.9:rc1,1.2.10:beta1,1.2.10:beta2,1.2.10:beta3,1.2.10:beta4,1.2.10:beta5,1.2.10:beta6,1.2.10:beta7,1.2.10:rc1,1.2.10:rc2,1.2.10:rc3,1.2.11:beta1,1.2.11:beta2,1.2.11:beta3,1.2.11:beta4,1.2.11:rc1,1.2.11:rc2,1.2.11:rc3,1.2.11:rc5,1.2.13:beta1,1.2.13:rc1,1.2.13:rc2,1.2.14:beta1,1.2.14:beta2,1.2.14:rc1,1.2.15:beta1,1.2.15:beta2,1.2.15:beta3,1.2.15:beta4,1.2.15:beta5,1.2.15:beta6,1.2.15:rc1,1.2.15:rc2,1.2.15:rc3,1.2.15:rc4,1.2.15:rc5,1.2.16:beta1,1.2.16:beta2,1.2.16:rc1,1.2.17:beta1,1.2.17:beta2,1.2.17:rc1,1.2.17:rc2,1.2.17:rc3,1.2.17:rc4,1.2.19:beta1,1.2.19:beta10,1.2.19:beta11,1.2.19:beta12,1.2.19:beta13,1.2.19:beta14,1.2.19:beta15,1.2.19:beta16,1.2.19:beta17,1.2.19:beta18,1.2.19:beta19,1.2.19:beta2,1.2.19:beta20,1.2.19:beta21,1.2.19:beta22,1.2.19:beta23,1.2.19:beta24,1.2.19:beta25,1.2.19:beta26,1.2.19:beta27,1.2.19:beta28,1.2.19:beta29,1.2.19:beta3,1.2.19:beta30,1.2.19:beta31,1.2.19:beta4,1.2.19:beta5,1.2.19:beta6,1.2.19:beta7,1.2.19:beta8,1.2.19:beta9,1.2.19:rc1,1.2.19:rc2,1.2.19:rc3,1.2.19:rc4,1.2.19:rc5,1.2.19:rc6,1.2.20:beta01,1.2.20:beta02,1.2.20:beta03,1.2.20:beta04,1.2.20:rc1,1.2.20:rc2,1.2.20:rc3,1.2.20:rc4,1.2.20:rc5,1.2.20:rc6,1.2.21:rc3,1.2.22:beta1,1.2.22:beta2,1.2.22:beta2-1.2.21,1.2.22:beta3,1.2.22:beta3-1.2.21,1.2.22:beta4,1.2.22:beta4-1.2.21,1.2.22:rc1,1.2.22:rc1-1.2.21,1.2.23:beta01,1.2.23:beta02,1.2.23:beta03,1.2.23:beta04,1.2.23:beta05,1.2.23:rc01,1.2.24:beta01,1.2.24:beta02,1.2.24:beta03,1.2.24:rc01,1.2.25:beta01,1.2.25:beta02,1.2.25:beta03,1.2.25:beta04,1.2.25:beta05,1.2.25:beta06,1.2.25:rc01,1.2.25:rc02,1.2.26:beta01,1.2.26:beta02,1.2.26:beta03,1.2.26:beta04,1.2.26:beta05,1.2.26:beta06,1.2.26:rc01,1.4:beta1,1.4:beta10,1.4:beta11,1.4:beta12,1.4:beta13,1.4:beta14,1.4:beta15,1.4:beta16,1.4:beta17,1.4:beta18,1.4:beta19,1.4:beta2,1.4:beta3,1.4:beta4,1.4:beta5,1.4:beta6,1.4:beta7,1.4:beta8,1.4:beta9