CVE-2017-12652
libpng: does not check length of chunks against user limit
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
En libpng anterior a versión 1.6.32, no comprueba apropiadamente la longitud de fragmentos en comparación con el límite del usuario.
It was discovered that libpng incorrectly handled memory when parsing certain PNG files. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service, or possible execute arbitrary code. Zhengxiong Luo discovered that libpng incorrectly handled memory when parsing certain PNG files. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service, or possible execute arbitrary code.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-08-07 CVE Reserved
- 2019-07-10 CVE Published
- 2024-08-05 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/109269 | Broken Link | |
| https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE | Release Notes | |
| https://security.netapp.com/advisory/ntap-20220506-0003 | Third Party Advisory |
|
| https://support.f5.com/csp/article/K88124225 | Third Party Advisory | |
| https://support.f5.com/csp/article/K88124225?utm_source=f5support&%3Butm_medium=RSS | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2017-12652 | 2020-09-29 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1733956 | 2020-09-29 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Libpng Search vendor "Libpng" | Libpng Search vendor "Libpng" for product "Libpng" | < 1.6.32 Search vendor "Libpng" for product "Libpng" and version " < 1.6.32" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | vsphere |
Affected
| ||||||