CVE-2015-8472

Publication date 9 December 2015

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.3 · High

Score breakdown

Description

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.

Read the notes from the security team

Status

Package Ubuntu Release Status
chromium-browser 15.10 wily
Not affected
15.04 vivid
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected
firefox 15.10 wily
Not affected
15.04 vivid
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected
libpng 15.10 wily
Fixed 1.2.51-0ubuntu3.15.10.2
15.04 vivid
Fixed 1.2.51-0ubuntu3.15.04.2
14.04 LTS trusty
Fixed 1.2.50-1ubuntu2.14.04.2
12.04 LTS precise
Fixed 1.2.46-3ubuntu4.2
openjdk-6 15.10 wily
Not affected
15.04 vivid
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected
openjdk-7 15.10 wily
Not affected
15.04 vivid
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected
openjdk-8 15.10 wily
Not affected
15.04 vivid
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise Not in release
thunderbird 15.10 wily
Not affected
15.04 vivid
Not affected
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected

Notes

seth-arnold

Incomplete fix for CVE-2015-8126

chriscoulson

firefox and thunderbird are not-affected since they don't use png_set_PLTE, see https://bugzilla.mozilla.org/show_bug.cgi?id=1224244#c0)

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libpng

Severity score breakdown

Parameter Value
Base score 7.3 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact Low
Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

    • USN-2861-1
    • libpng vulnerabilities
    • 6 January 2016

Other references