CVE-2015-8540 Integer overflow in n/a
Remote attackers can trigger an out-of-bounds read via a crafted PNG image, potentially causing application crashes or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-8540?
CVE-2015-8540 is a high-severity vulnerability in Debian Debian Linux, published on 14 Apr 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read.
Weakness: CWE-189
Which versions are affected by CVE-2015-8540?
It affects 7 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Libpng Libpng, Redhat Enterprise Linux Desktop Supplementary, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server Supplementary and 1 more.
How do I fix CVE-2015-8540?
Upgrade to a fixed version.
Is CVE-2015-8540 being exploited?
There is no known exploitation of CVE-2015-8540 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-7qhq-6293-wrx3, MGASA-2015-0489, UBUNTU-CVE-2015-8540.