Evil-DB LogoEvil-DB
← All CVEs

CVE-2015-8126

high · 7.5

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

7.5
CVSS
10.3%
EPSS (exploit prob.)
95th
EPSS percentile
2015-11-13
Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-120

Affected products

VendorProductAffected versions
libpnglibpng< 1.0.64
libpnglibpng>= 1.1.1, < 1.2.54
libpnglibpng>= 1.3.0, < 1.4.17
libpnglibpng>= 1.5.0, < 1.5.24
libpnglibpng>= 1.6.0, < 1.6.19
fedoraprojectfedora21
fedoraprojectfedora22
fedoraprojectfedora23
opensuseleap42.1
opensuseopensuse13.1
opensuseopensuse13.2
suselinux_enterprise_desktop11
suselinux_enterprise_desktop11
suselinux_enterprise_desktop12
suselinux_enterprise_desktop12
suselinux_enterprise_server12
suselinux_enterprise_server12
debiandebian_linux7.0
debiandebian_linux8.0
debiandebian_linux9.0
redhatsatellite5.7
redhatenterprise_linux_desktop6.0
redhatenterprise_linux_desktop7.0
redhatenterprise_linux_eus6.7
redhatenterprise_linux_eus7.2
redhatenterprise_linux_eus7.3
redhatenterprise_linux_eus7.4
redhatenterprise_linux_eus7.5
redhatenterprise_linux_eus7.6
redhatenterprise_linux_eus7.7
redhatenterprise_linux_server6.0
redhatenterprise_linux_server7.0
redhatenterprise_linux_server_aus7.2
redhatenterprise_linux_server_aus7.3
redhatenterprise_linux_server_aus7.4
redhatenterprise_linux_server_aus7.6
redhatenterprise_linux_server_aus7.7
redhatenterprise_linux_server_tus7.2
redhatenterprise_linux_server_tus7.3
redhatenterprise_linux_server_tus7.6

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-8126