CVE-2020-27818

Ubuntu Security Notice USN-6182-1

Severity Score

3.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temporary denial of service, posing a low risk to application availability.

Se encontró un fallo en la función check_chunk_name() de pngcheck-2.4.0. Un atacante capaz de pasar un archivo malicioso para ser procesado por pngcheck podría causar una denegación temporal de servicio, lo que supone un bajo riesgo para la disponibilidad de la aplicación.

An update that fixes one vulnerability is now available. This update for pngcheck fixes the following issues. Fixed a global buffer overflow in check_chunk_name function via crafted pngfile. This update was imported from the openSUSE:Leap:15.2:Update update project.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-10-27 CVE Reserved
2020-12-06 CVE Published
2024-08-04 CVE Updated
2025-01-19 First Exploit
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-125: Out-of-bounds Read

CAPEC

References (9)

URL	Tag	Source
https://bodhi.fedoraproject.org/updates/FEDORA-2020-04d5e1ce26	Third Party Advisory
https://bodhi.fedoraproject.org/updates/FEDORA-2020-23432b7b72	Third Party Advisory
https://bodhi.fedoraproject.org/updates/FEDORA-2020-27b168926a	Third Party Advisory
https://bodhi.fedoraproject.org/updates/FEDORA-2020-4349e95c4f	Third Party Advisory
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-339db397ad	Third Party Advisory
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-6c93c61069	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1902011	Issue Tracking
https://lists.debian.org/debian-lts-announce/2022/05/msg00043.html	Mailing List

URL	Date	SRC
https://github.com/13m0n4de/pngcheck-vulns	2025-01-19

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Libpng Search vendor "Libpng"		Pngcheck Search vendor "Libpng" for product "Pngcheck"				2.4.0 Search vendor "Libpng" for product "Pngcheck" and version "2.4.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Extra Packages For Enterprise Linux Search vendor "Fedoraproject" for product "Extra Packages For Enterprise Linux"				7.0 Search vendor "Fedoraproject" for product "Extra Packages For Enterprise Linux" and version "7.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Extra Packages For Enterprise Linux Search vendor "Fedoraproject" for product "Extra Packages For Enterprise Linux"				8.0 Search vendor "Fedoraproject" for product "Extra Packages For Enterprise Linux" and version "8.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				31 Search vendor "Fedoraproject" for product "Fedora" and version "31"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				32 Search vendor "Fedoraproject" for product "Fedora" and version "32"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				33 Search vendor "Fedoraproject" for product "Fedora" and version "33"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0"		-		Affected