Vulnerability Details CVE-2018-14048
An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 50.4%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.3
References
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://github.com/fouzhe/security/tree/master/libpng
- https://github.com/glennrp/libpng/issues/238
- https://seclists.org/bugtraq/2019/Apr/30
- https://security.gentoo.org/glsa/201908-02
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://github.com/fouzhe/security/tree/master/libpng
- https://github.com/glennrp/libpng/issues/238
- https://seclists.org/bugtraq/2019/Apr/30
- https://security.gentoo.org/glsa/201908-02
Products affected by CVE-2018-14048
-
cpe:2.3:a:libpng:libpng:1.6.34
-
cpe:2.3:a:oracle:jdk:1.6.0
-
cpe:2.3:a:oracle:jdk:1.7.0
-
cpe:2.3:a:oracle:jdk:1.8.0
-
cpe:2.3:a:oracle:jdk:11.0.0
-
cpe:2.3:a:oracle:jre:1.6.0
-
cpe:2.3:a:oracle:jre:1.7.0
-
cpe:2.3:a:oracle:jre:1.8.0
-
cpe:2.3:a:oracle:jre:11.0.0