CVE-2016-3981
HighSummary
Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before version 0.7.6 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted image file.
Risk Assessment
Organizations may be exposed to denial of service and the potential for remote code execution, leading to serious security implications.
Recommendation
It is recommended to update OptiPNG to version 0.7.6 or later to mitigate this vulnerability.
Other vulnerabilities in OptiPNG
See all- CVE-2017-16938High
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact using a maliciously crafted GIF format file. The issue is related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
- CVE-2017-1000229High
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- CVE-2015-7801High
Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.
- CVE-2016-3982High
Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before version 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, triggering a heap-based buffer overflow.
Original NVD description (English source)
Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.