CVE-2017-16938
HighSummary
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact using a maliciously crafted GIF format file. The issue is related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.
Risk Assessment
Organizations may be vulnerable to denial-of-service attacks, potentially leading to system downtime and loss of service availability.
Recommendation
It is recommended to update OptiPNG to the latest version to mitigate this vulnerability and to monitor systems for unauthorized attempts to exploit this flaw.
Other vulnerabilities in OptiPNG 0.7.6
See all- CVE-2017-1000229High
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- CVE-2015-7801High
Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.
- CVE-2016-3982High
Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before version 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, triggering a heap-based buffer overflow.
- CVE-2016-3981High
Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before version 0.7.6 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted image file.
Original NVD description (English source)
A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.