CVE-2015-8126 - CVE House
Back to Database
Status published High CVE-2015-8126

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE...

Vulnerability Description

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-8126

Credits & Attribution

No credits recorded in the NVD database.

References

More from libpng

View All →
CVE-2019-7317
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a...
Unknown 0
CVE-2019-6129
png_create_info_struct in png.c in libpng 1.6.36 has a memory leak,...
Unknown 0
CVE-2018-14550
An issue has been found in third-party PNM decoding associated...
High 8.8
CVE-2018-14048
An issue has been found in libpng 1.6.34. It is...
Medium 6.5
CVE-2018-13785
In libpng 1.6.34, a wrong calculation of row_factor in the...
Unknown 0

Affected Vendor

Affected Software

libpng, fedora, leap, opensuse, linux enterprise desktop, linux enterprise server, debian linux, satellite, enterprise linux desktop, enterprise linux eus, enterprise linux server, enterprise linux server aus, enterprise linux server tus, enterprise linux workstation, jdk, jre, linux, solaris, mac os x, ubuntu linux
Vulnerable Versions:
0, 1.1.1, 1.3.0, 1.5.0, 1.6.0, 21, 22, 23, 42.1, 13.1, 13.2, 11, 12, 7.0, 8.0, 9.0, 5.7, 5.6, 6.0, 6.7, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7, 1.7.0, 1.8.0, 6, 7, 11.3, 12.04, 14.04, 15.04, 15.10

Timeline

Official Publish: November 13th, 2015
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.