VulnerabilityModified

CVE-2015-8126

HIGH 7.5EPSS 10.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 10.3%, higher than 95% of all known CVEs. Patch or mitigate before the next change window.

Description

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 10.34% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-120
Affected: libpng/libpng · fedoraproject/fedora · opensuse/leap · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise server · debian/debian linux · redhat/satellite · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server tus · redhat/enterprise linux workstation · oracle/jdk · oracle/jre · oracle/linux · oracle/solaris · apple/mac os x · canonical/ubuntu linux
Source: cve@mitre.org

References

http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.htmlThird Party Advisory
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlMailing List, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172324.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172769.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172797.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172823.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177344.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177382.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.htmlMailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.