Sign-up

ID

VAR-201501-0119


CVE

CVE-2015-0973


TITLE

libpng of pngrutil.c Inside png_read_IDAT_data Buffer overflow vulnerability in functions

Trust: 0.8

sources: JVNDB: JVNDB-2015-001198

DESCRIPTION

Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495. libpng is prone to multiple heap-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input. Failed attacks will cause denial-of-service conditions. libpng is a PNG reference library that can create, read and write PNG graphics files. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002 OS X El Capitan 10.11.4 and Security Update 2016-002 is now available and addresses the following: apache_mod_php Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1733 : Proteas of Qihoo 360 Nirvan Team AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1732 : Proteas of Qihoo 360 Nirvan Team AppleUSBNetworking Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the parsing of data from USB devices. This issue was addressed through improved input validation. CVE-ID CVE-2016-1734 : Andrea Barisani and Andrej Rosano of Inverse Path Bluetooth Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1735 : Jeonghoon Shin@A.D.D CVE-2016-1736 : beist and ABH of BoB Carbon Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .dfont file may lead to arbitrary code execution Description: Multiple memory corruption issues existed in the handling of font files. These issues were addressed through improved bounds checking. CVE-ID CVE-2016-1737 : an anonymous researcher dyld Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker may tamper with code-signed applications to execute arbitrary code in the application's context Description: A code signing verification issue existed in dyld. This issue was addressed with improved validation. CVE-ID CVE-2016-1738 : beist and ABH of BoB FontParser Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1740 : HappilyCoded (ant4g0nist and r3dsm0k3) working with Trend Micro's Zero Day Initiative (ZDI) HTTPProtocol Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to execute arbitrary code Description: Multiple vulnerabilities existed in nghttp2 versions prior to 1.6.0, the most serious of which may have led to remote code execution. These were addressed by updating nghttp2 to version 1.6.0. CVE-ID CVE-2015-8659 Intel Graphics Driver Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1743 : Piotr Bania of Cisco Talos CVE-2016-1744 : Ian Beer of Google Project Zero IOFireWireFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to cause a denial of service Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1745 : sweetchip of Grayhash IOGraphics Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1746 : Peter Pi of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1747 : Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) IOHIDFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1748 : Brandon Azad IOUSBFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1749 : Ian Beer of Google Project Zero and Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-ID CVE-2016-1750 : CESG Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition existed during the creation of new processes. This was addressed through improved state handling. CVE-ID CVE-2016-1757 : Ian Beer of Google Project Zero and Pedro Vilaca Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved input validation. CVE-ID CVE-2016-1756 : Lufeng Li of Qihoo 360 Vulcan Team Kernel Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1754 : Lufeng Li of Qihoo 360 Vulcan Team CVE-2016-1755 : Ian Beer of Google Project Zero CVE-2016-1759 : lokihardt Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1758 : Brandon Azad Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple integer overflows were addressed through improved input validation. CVE-ID CVE-2016-1753 : Juwei Lin Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to cause a denial of service Description: A denial of service issue was addressed through improved validation. CVE-ID CVE-2016-1752 : CESG libxml2 Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing maliciously crafted XML may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2015-1819 CVE-2015-5312 : David Drysdale of Google CVE-2015-7499 CVE-2015-7500 : Kostya Serebryany of Google CVE-2015-7942 : Kostya Serebryany of Google CVE-2015-8035 : gustavo.grieco CVE-2015-8242 : Hugh Davenport CVE-2016-1761 : wol0xff working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1762 Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker who is able to bypass Apple's certificate pinning, intercept TLS connections, inject messages, and record encrypted attachment-type messages may be able to read attachments Description: A cryptographic issue was addressed by rejecting duplicate messages on the client. CVE-ID CVE-2016-1788 : Christina Garman, Matthew Green, Gabriel Kaptchuk, Ian Miers, and Michael Rushanan of Johns Hopkins University Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a JavaScript link can reveal sensitive user information Description: An issue existed in the processing of JavaScript links. This issue was addressed through improved content security policy checks. CVE-ID CVE-2016-1764 : Matthew Bryan of the Uber Security Team (formerly of Bishop Fox), Joe DeMesy and Shubham Shah of Bishop Fox NVIDIA Graphics Drivers Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1741 : Ian Beer of Google Project Zero OpenSSH Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Connecting to a server may leak sensitive user information, such as a client's private keys Description: Roaming, which was on by default in the OpenSSH client, exposed an information leak and a buffer overflow. These issues were addressed by disabling roaming in the client. CVE-ID CVE-2016-0777 : Qualys CVE-2016-0778 : Qualys OpenSSH Available for: OS X Mavericks v10.9.5 and OS X Yosemite v10.10.5 Impact: Multiple vulnerabilities in LibreSSL Description: Multiple vulnerabilities existed in LibreSSL versions prior to 2.1.8. These were addressed by updating LibreSSL to version 2.1.8. CVE-ID CVE-2015-5333 : Qualys CVE-2015-5334 : Qualys OpenSSL Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to cause a denial of service Description: A memory leak existed in OpenSSL versions prior to 0.9.8zh. This issue was addressed by updating OpenSSL to version 0.9.8zh. CVE-ID CVE-2015-3195 Python Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2014-9495 CVE-2015-0973 CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted FlashPix Bitmap Image may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1767 : Francis Provencher from COSIG CVE-2016-1768 : Francis Provencher from COSIG QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted Photoshop document may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1769 : Francis Provencher from COSIG Reminders Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a tel link can make a call without prompting the user Description: A user was not prompted before invoking a call. This was addressed through improved entitlement checks. CVE-ID CVE-2016-1770 : Guillaume Ross of Rapid7 and Laurent Chouinard of Laurent.ca Ruby Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution Description: An unsafe tainted string usage vulnerability existed in versions prior to 2.0.0-p648. This issue was addressed by updating to version 2.0.0-p648. CVE-ID CVE-2015-7551 Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to check for the existence of arbitrary files Description: A permissions issue existed in code signing tools. This was addressed though additional ownership checks. CVE-ID CVE-2016-1773 : Mark Mentovai of Google Inc. Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted certificate may lead to arbitrary code execution Description: A memory corruption issue existed in the ASN.1 decoder. This issue was addressed through improved input validation. CVE-ID CVE-2016-1950 : Francis Gabriel of Quarkslab Tcl Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by removing libpng. CVE-ID CVE-2015-8126 : Adam Mariš TrueTypeScaler Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation. CVE-ID CVE-2016-1775 : 0x1byte working with Trend Micro's Zero Day Initiative (ZDI) Wi-Fi Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker with a privileged network position may be able to execute arbitrary code Description: A frame validation and memory corruption issue existed for a given ethertype. This issue was addressed through additional ethertype validation and improved memory handling. CVE-ID CVE-2016-0801 : an anonymous researcher CVE-2016-0802 : an anonymous researcher OS X El Capitan 10.11.4 includes the security content of Safari 9.1. https://support.apple.com/kb/HT206171 OS X El Capitan v10.11.4 and Security Update 2016-002 may be obtained from the Mac App Store or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJW8JQFAAoJEBcWfLTuOo7tZSYP/1bHFA1qemkD37uu7nYpk/q6 ARVsPgME1I1+5tOxX0TQJgzMBmdQsKYdsTiLpDk5HTuv+dAMsFfasaUItGk8Sz1w HiYjSfVsxL+Pjz3vK8/4/fsi2lX6472MElRw8gudITOhXtniGcKo/vuA5dB+vM3l Jy1NLHHhZ6BD2t0bBmlz41mZMG3AMxal2wfqE+5LkjUwASzcvC/3B1sh7Fntwyau /71vIgMQ5AaETdgQJAuQivxPyTlFduBRgLjqvPiB9eSK4Ctu5t/hErFIrP2NiDCi UhfZC48XbiRjJfkUsUD/5TIKnI+jkZxOnch9ny32dw2kUIkbIAbqufTkzsMXOpng O+rI93Ni7nfzgI3EkI2bq+C+arOoRiveWuJvc3SMPD5RQHo4NCQVs0ekQJKNHF78 juPnY29n8WMjwLS6Zfm+bH+n8ELIXrmmEscRztK2efa9S7vJe+AgIxx7JE/f8OHF i9K7UQBXFXcpMjXi1aTby/IUnpL5Ny4NVwYwIhctj0Mf6wTH7uf/FMWYIQOXcIfP Izo+GXxNeLd4H2ypZ+UpkZg/Sn2mtCd88wLc96+owlZPBlSqWl3X1wTlp8i5FP2X qlQ7RcTHJDv8jPT/MOfzxEK1n/azp45ahHA0o6nohUdxlA7PLci9vPiJxqKPo/0q VZmOKa8qMxB1L/JmdCqy =mZR+ -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2015-0973 // JVNDB: JVNDB-2015-001198 // BID: 71994 // VULHUB: VHN-78919 // VULMON: CVE-2015-0973 // PACKETSTORM: 136346

AFFECTED PRODUCTS

vendor:libpngmodel:libpngscope:eqversion:1.6.15

Trust: 1.6

vendor:libpngmodel:libpngscope:eqversion:1.6.14

Trust: 1.6

vendor:libpngmodel:libpngscope:eqversion:1.6.12

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.2

Trust: 1.0

vendor:oraclemodel:solarisscope:eqversion:11.2

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.5

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.4

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.9

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.13

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.10

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.3

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.7

Trust: 1.0

vendor:libpngmodel:libpngscope:lteversion:1.5.20

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.6

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.1

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.0

Trust: 1.0

vendor:applemodel:mac os xscope:lteversion:10.11.3

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.8

Trust: 1.0

vendor:libpngmodel:libpngscope:eqversion:1.6.11

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.9.5

Trust: 0.8

vendor:png groupmodel:libpngscope:ltversion:1.6.x

Trust: 0.8

vendor:png groupmodel:libpngscope:eqversion:1.6.16

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.10.5

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.11 to 10.11.3

Trust: 0.8

vendor:libpngmodel:libpngscope:eqversion:1.5.5

Trust: 0.3

vendor:libpngmodel:libpngscope:eqversion:1.5.4

Trust: 0.3

vendor:libpngmodel:libpngscope:eqversion:1.5

Trust: 0.3

vendor:libpngmodel:libpngscope:eqversion:1.5.8

Trust: 0.3

vendor:libpngmodel:libpngscope:eqversion:1.5.7

Trust: 0.3

vendor:libpngmodel:libpngscope:eqversion:1.5.6

Trust: 0.3

vendor:libpngmodel:libpngscope:eqversion:1.5.10

Trust: 0.3

vendor:ibmmodel:tivoli common reportingscope:eqversion:2.1

Trust: 0.3

sources: BID: 71994 // JVNDB: JVNDB-2015-001198 // CNNVD: CNNVD-201501-232 // NVD: CVE-2015-0973

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-0973
value: HIGH

Trust: 1.0

NVD: CVE-2015-0973
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201501-232
value: HIGH

Trust: 0.6

VULHUB: VHN-78919
value: HIGH

Trust: 0.1

VULMON: CVE-2015-0973
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-0973
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-78919
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-78919 // VULMON: CVE-2015-0973 // JVNDB: JVNDB-2015-001198 // CNNVD: CNNVD-201501-232 // NVD: CVE-2015-0973

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-78919 // JVNDB: JVNDB-2015-001198 // NVD: CVE-2015-0973

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201501-232

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201501-232

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-001198

PATCH
title:APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002url:http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html
Trust: 0.8
title:HT206167url:https://support.apple.com/en-us/HT206167
Trust: 0.8
title:HT206167url:https://support.apple.com/ja-jp/HT206167
Trust: 0.8
title:1698994url:http://www-01.ibm.com/support/docview.wss?uid=swg21698994
Trust: 0.8
title:1697791url:http://www-01.ibm.com/support/docview.wss?uid=swg21697791
Trust: 0.8
title:1699393url:http://www-01.ibm.com/support/docview.wss?uid=swg21699393
Trust: 0.8
title:1700399url:http://www-01.ibm.com/support/docview.wss?uid=swg21700399
Trust: 0.8
title:Top Pageurl:http://www.libpng.org/pub/png/libpng.html
Trust: 0.8
title:Oracle Solaris Third Party Bulletin - July 2015url:http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
Trust: 0.8
title:[png-mng-announce] libpng-1.5.21 and 1.6.16 are availableurl:http://sourceforge.net/p/png-mng/mailman/message/33173461/
Trust: 0.8
title:Red Hat: CVE-2015-0973url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2015-0973
Trust: 0.1
title:Android Security Bulletins: Nexus Security Bulletin - August 2015url:https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins&qid=d64e515c015d4df246a74c08251f89a3
Trust: 0.1
title:Apple: OS X El Capitan v10.11.4 and Security Update 2016-002url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=ef054ba76412200e34091eb91c38c281
Trust: 0.1
title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2015url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=8b701aba68029ec36b631a8e26157a22
Trust: 0.1
sources:
            
            
            VULMON: CVE-2015-0973 // 
            
            
            
            JVNDB: JVNDB-2015-001198

EXTERNAL IDS
db:NVDid:CVE-2015-0973
Trust: 3.0
db:OPENWALLid:OSS-SECURITY/2015/01/10/1
Trust: 2.6
db:OPENWALLid:OSS-SECURITY/2015/01/10/3
Trust: 1.8
db:SECUNIAid:62725
Trust: 1.2
db:BIDid:71994
Trust: 1.1
db:JVNid:JVNVU97668313
Trust: 0.8
db:JVNDBid:JVNDB-2015-001198
Trust: 0.8
db:CNNVDid:CNNVD-201501-232
Trust: 0.7
db:NSFOCUSid:28941
Trust: 0.6
db:VULHUBid:VHN-78919
Trust: 0.1
db:VULMONid:CVE-2015-0973
Trust: 0.1
db:PACKETSTORMid:136346
Trust: 0.1
sources:
            
            
            VULHUB: VHN-78919 // 
            
            
            
            VULMON: CVE-2015-0973 // 
            
            
            
            BID: 71994 // 
            
            
            
            JVNDB: JVNDB-2015-001198 // 
            
            
            
            PACKETSTORM: 136346 // 
            
            
            
            CNNVD: CNNVD-201501-232 // 
            
            
            
            NVD: CVE-2015-0973

REFERENCES
url:http://www.openwall.com/lists/oss-security/2015/01/10/1
Trust: 2.6
url:http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt
Trust: 2.1
url:http://www.openwall.com/lists/oss-security/2015/01/10/3
Trust: 1.8
url:http://sourceforge.net/p/png-mng/mailman/message/33173461/
Trust: 1.8
url:http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
Trust: 1.5
url:http://lists.apple.com/archives/security-announce/2016/mar/msg00004.html
Trust: 1.2
url:https://support.apple.com/ht206167
Trust: 1.2
url:http://secunia.com/advisories/62725
Trust: 1.2
url:https://security.netapp.com/advisory/ntap-20240719-0005/
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0973
Trust: 0.8
url:http://jvn.jp/vu/jvnvu97668313/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-0973
Trust: 0.8
url:http://www.securityfocus.com/bid/71994
Trust: 0.7
url:http://www.nsfocus.net/vulndb/28941
Trust: 0.6
url:http://www.libpng.org/pub/png/libpng.html
Trust: 0.3
url:http://sourceforge.net/p/png-mng/mailman/message/33172831/
Trust: 0.3
url:http://www-01.ibm.com/support/docview.wss?uid=swg21698818
Trust: 0.3
url:http://www-01.ibm.com/support/docview.wss?uid=swg21697296
Trust: 0.3
url:http://www-01.ibm.com/support/docview.wss?uid=swg21903299
Trust: 0.3
url:http://www-01.ibm.com/support/docview.wss?uid=swg21685985
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-0973
Trust: 0.1
url:https://source.android.com/security/bulletin/2015-08-01.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-7551
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-0777
Trust: 0.1
url:https://support.apple.com/kb/ht201222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-8659
Trust: 0.1
url:https://gpgtools.org
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-8035
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-8472
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1819
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-3195
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-7499
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-0801
Trust: 0.1
url:http://www.apple.com/support/downloads/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-8242
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-8126
Trust: 0.1
url:https://support.apple.com/kb/ht206171
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1732
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5312
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-7942
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-7500
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-9495
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1734
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1740
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5334
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1733
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1736
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1735
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-0778
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5333
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-0802
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1738
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1737
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-0973
Trust: 0.1
sources:
            
            
            VULHUB: VHN-78919 // 
            
            
            
            VULMON: CVE-2015-0973 // 
            
            
            
            BID: 71994 // 
            
            
            
            JVNDB: JVNDB-2015-001198 // 
            
            
            
            PACKETSTORM: 136346 // 
            
            
            
            CNNVD: CNNVD-201501-232 // 
            
            
            
            NVD: CVE-2015-0973

CREDITS
John Bowler
Trust: 0.9
sources:
            
            
            BID: 71994 // 
            
            
            
            CNNVD: CNNVD-201501-232

SOURCES
db:VULHUBid:VHN-78919
db:VULMONid:CVE-2015-0973
db:BIDid:71994
db:JVNDBid:JVNDB-2015-001198
db:PACKETSTORMid:136346
db:CNNVDid:CNNVD-201501-232
db:NVDid:CVE-2015-0973

LAST UPDATE DATE
2024-11-23T20:33:13.292000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-78919date:2016-10-20T00:00:00
db:VULMONid:CVE-2015-0973date:2016-10-20T00:00:00
db:BIDid:71994date:2016-07-06T14:08:00
db:JVNDBid:JVNDB-2015-001198date:2016-03-29T00:00:00
db:CNNVDid:CNNVD-201501-232date:2015-01-19T00:00:00
db:NVDid:CVE-2015-0973date:2024-11-21T02:24:03.720

SOURCES RELEASE DATE
db:VULHUBid:VHN-78919date:2015-01-18T00:00:00
db:VULMONid:CVE-2015-0973date:2015-01-18T00:00:00
db:BIDid:71994date:2015-01-10T00:00:00
db:JVNDBid:JVNDB-2015-001198date:2015-01-23T00:00:00
db:PACKETSTORMid:136346date:2016-03-22T15:18:02
db:CNNVDid:CNNVD-201501-232date:2015-01-13T00:00:00
db:NVDid:CVE-2015-0973date:2015-01-18T18:59:03.020