Vulnerability of libpng: memory leak via png_create_info_struct

Synthesis of the vulnerability

An attacker can create a memory leak via png_create_info_struct() of libpng, in order to trigger a denial of service.

Impacted products: NetWorker, Fedora, Notes by HCL, Notes by IBM, libpng, Java OpenJDK, Java Oracle.

Severity of this bulletin: 1/4.

Creation date: 14/01/2019.

Références of this threat: 269, cpujul2019, CVE-2019-6129, DSA-2020-198, FEDORA-2019-5c794ec7ba, FEDORA-2019-a5ec38072a, KB0088721, VIGILANCE-VUL-28269.

Description of the vulnerability

An attacker can create a memory leak via png_create_info_struct() of libpng, in order to trigger a denial of service.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This security weakness impacts software or systems such as NetWorker, Fedora, Notes by HCL, Notes by IBM, libpng, Java OpenJDK, Java Oracle.

Our Vigil@nce team determined that the severity of this threat bulletin is low.

The trust level is of type confirmed by the editor, with an origin of document.

An attacker with a expert ability can exploit this threat.

Solutions for this threat

Dell EMC NetWorker Virtual Edition: patch for Java.
A patch is indicated in information sources.

Fedora: new java-1.8.0-openjdk-aarch32 packages.
New packages are available:
Fedora 30: java-1.8.0-openjdk-aarch32 1.8.0.222.b10-1.fc30
Fedora 29: java-1.8.0-openjdk-aarch32 1.8.0.222.b10-1.fc29

HCL Notes: patch for libpng.
A patch is indicated in information sources.

Oracle Java: version 11.0.4.
The version 11.0.4 is fixed:
http://www.oracle.com/technetwork/indexes/downloads/index.html
https://www.oracle.com/technetwork/java/javase/11u-relnotes-5093844.html

Oracle Java: version 12.0.2.
The version 12.0.2 is fixed:
http://www.oracle.com/technetwork/indexes/downloads/index.html
https://www.oracle.com/technetwork/java/javase/12u-relnotes-5211424.html

Oracle Java: version 7u231.
The version 7u231 is fixed:
http://www.oracle.com/technetwork/indexes/downloads/index.html
http://www.oracle.com/technetwork/java/javase/documentation/javase7supportreleasenotes-1601161.html

Oracle Java: version 8u221.
The version 8u221 is fixed:
http://www.oracle.com/technetwork/indexes/downloads/index.html
http://www.oracle.com/technetwork/java/javase/documentation/8u-relnotes-2225394.html
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service

Vigil@nce provides an application vulnerability alert. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system.