What’s Vulnerable › Vulnerabilities

CVE-2015-8540

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-04-14 · updated 2026-06-17
• Weakness: CWE-189

Description

Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read.

Affected products

• Debian Linux: 6.0
• Fedoraproject Fedora: 23
• pnggroup libpng: 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5 (+184)
• RedHat Enterprise Linux Desktop Supplementary: 5.0, 6.0
• RedHat Enterprise Linux Hpc Node: 6.0
• RedHat Enterprise Linux Server Supplementary: 5.0, 6.0
• RedHat Enterprise Linux Workstation Supplementary: 6.0

References

• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174435.html
• http://sourceforge.net/p/libpng/bugs/244/
• http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815b42ed/
• http://sourceforge.net/projects/libpng/files/libpng10/1.0.66/
• http://sourceforge.net/projects/libpng/files/libpng12/1.2.56/
• http://sourceforge.net/projects/libpng/files/libpng14/1.4.19/
• http://sourceforge.net/projects/libpng/files/libpng15/1.5.26/
• http://www.debian.org/security/2016/dsa-3443
• http://www.openwall.com/lists/oss-security/2015/12/10/6
• http://www.openwall.com/lists/oss-security/2015/12/10/7
• http://www.openwall.com/lists/oss-security/2015/12/11/1
• http://www.openwall.com/lists/oss-security/2015/12/11/2

Get alerted when CVE-2015-8540 or the next vulnerability affects your stack