CVE-2015-8126

一、漏洞信息
 漏洞编号：[CVE-2015-8126](https://nvd.nist.gov/vuln/detail/CVE-2015-8126)
 漏洞归属组件：[syslinux](https://gitee.com/src-openeuler/syslinux)
 漏洞归属的版本：1.6.40
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/
 漏洞简述：
  Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
 漏洞公开时间：2015-11-13 11:59
 漏洞创建时间：2024-05-21 17:17:30
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2015-8126
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html |  |
| cve.mitre.org | http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172324.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172769.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172797.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172823.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177344.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177382.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.html |  |
| cve.mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-updates/2015-12/msg00062.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-updates/2015-12/msg00063.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-updates/2016-01/msg00028.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-updates/2016-01/msg00029.html |  |
| cve.mitre.org | http://lists.opensuse.org/opensuse-updates/2016-01/msg00030.html |  |
| cve.mitre.org | http://rhn.redhat.com/errata/RHSA-2015-2594.html |  |
| cve.mitre.org | http://rhn.redhat.com/errata/RHSA-2015-2595.html |  |
| cve.mitre.org | http://rhn.redhat.com/errata/RHSA-2015-2596.html |  |
| cve.mitre.org | http://rhn.redhat.com/errata/RHSA-2016-0055.html |  |
| cve.mitre.org | http://rhn.redhat.com/errata/RHSA-2016-0056.html |  |
| cve.mitre.org | http://rhn.redhat.com/errata/RHSA-2016-0057.html |  |
| cve.mitre.org | http://www.debian.org/security/2015/dsa-3399 |  |
| cve.mitre.org | http://www.debian.org/security/2016/dsa-3507 |  |
| cve.mitre.org | http://www.openwall.com/lists/oss-security/2015/11/12/2 |  |
| cve.mitre.org | http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html |  |
| cve.mitre.org | http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html |  |
| cve.mitre.org | http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html |  |
| cve.mitre.org | http://www.securityfocus.com/bid/77568 |  |
| cve.mitre.org | http://www.securitytracker.com/id/1034142 |  |
| cve.mitre.org | http://www.ubuntu.com/usn/USN-2815-1 |  |
| cve.mitre.org | https://access.redhat.com/errata/RHSA-2016:1430 |  |
| cve.mitre.org | https://code.google.com/p/chromium/issues/detail?id=560291 |  |
| cve.mitre.org | https://kc.mcafee.com/corporate/index?page=content&id=SB10148 |  |
| cve.mitre.org | https://security.gentoo.org/glsa/201603-09 |  |
| cve.mitre.org | https://security.gentoo.org/glsa/201611-08 |  |
| cve.mitre.org | https://support.apple.com/HT206167 |  |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 | https://bugzilla.suse.com/show_bug.cgi?id=954980 |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8126 | https://bugzilla.suse.com/show_bug.cgi?id=954980 |
| suse_bugzilla | http://www.openwall.com/lists/oss-security/2015/11/12/2 | https://bugzilla.suse.com/show_bug.cgi?id=954980 |
| suse_bugzilla | http://seclists.org/oss-sec/2015/q4/264 | https://bugzilla.suse.com/show_bug.cgi?id=954980 |
| suse_bugzilla | http://www.cvedetails.com/cve/CVE-2015-8126/ | https://bugzilla.suse.com/show_bug.cgi?id=954980 |
| redhat_bugzilla | https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b7a766 | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208cb54d | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57d5978 | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466 | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324 | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | http://seclists.org/oss-sec/2015/q4/264 | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324.patch | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | http://seclists.org/oss-sec/2015/q4/439 | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2015-2594.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2015-2596.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2015-2595.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/817a472b15bd | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/23a6e0931277 | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2016-0057.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2016-0056.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2016-0055.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2016-0101.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2016-0100.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2016-0098.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://rhn.redhat.com/errata/RHSA-2016-0099.html | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2016:1430 | https://bugzilla.redhat.com/show_bug.cgi?id=1281756 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8126 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | http://www.openwall.com/lists/oss-security/2015/11/12/2 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://ubuntu.com/security/notices/USN-2815-1 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://bugzilla.mozilla.org/show_bug.cgi?id=1224244#c0 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2015-8126 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2015-8126 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2015-8126 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://bugs.launchpad.net/bugs/1516592 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://bugs.launchpad.net/bugs/1516651 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=805113 | https://ubuntu.com/security/CVE-2015-8126 |
| ubuntu | https://bugzilla.mozilla.org/show_bug.cgi?id=1224244#c0 | https://ubuntu.com/security/CVE-2015-8126 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2015-8126 |
| oracle |  | https://www.oracle.com/security-alerts/linuxbulletinoct2015.html |
| gentoo |  | https://security.gentoo.org/glsa/201603-09 |
| cve_search |  | http://www.openwall.com/lists/oss-security/2015/11/12/2 |
| cve_search |  | http://www.debian.org/security/2015/dsa-3399 |
| cve_search |  | http://www.ubuntu.com/usn/USN-2815-1 |
| cve_search |  | http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/glennrp/libpng/commit/81f44665cce4cb1373f049a76f3904e981b7a766 |  | redhat_bugzilla |
|  |  | https://github.com/glennrp/libpng/commit/a901eb3ce6087e0afeef988247f1a1aa208cb54d |  | redhat_bugzilla |
|  |  | https://github.com/glennrp/libpng/commit/1bef8e97995c33123665582e57d3ed40b57d5978 |  | redhat_bugzilla |
|  |  | https://github.com/glennrp/libpng/commit/83f4c735c88e7f451541c1528d8043c31ba3b466 |  | redhat_bugzilla |
|  |  | https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324 |  | redhat_bugzilla |
|  |  | https://github.com/glennrp/libpng/commit/9f2ad4928e47036cf1ac9b8fe45a491f15be2324.patch |  | redhat_bugzilla |
|  |  | http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/817a472b15bd |  | redhat_bugzilla |
|  |  | http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/23a6e0931277 |  | redhat_bugzilla |
|  |  | http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html |  | nvd |
|  |  | http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172324.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172620.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172647.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172663.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172769.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172797.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172823.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177344.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177382.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.html |  | nvd |
|  |  | http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-updates/2015-12/msg00062.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-updates/2015-12/msg00063.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-updates/2016-01/msg00028.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-updates/2016-01/msg00029.html |  | nvd |
|  |  | http://lists.opensuse.org/opensuse-updates/2016-01/msg00030.html |  | nvd |
|  |  | http://rhn.redhat.com/errata/RHSA-2015-2594.html |  | nvd |
|  |  | http://rhn.redhat.com/errata/RHSA-2015-2595.html |  | nvd |
|  |  | http://rhn.redhat.com/errata/RHSA-2015-2596.html |  | nvd |
|  |  | http://rhn.redhat.com/errata/RHSA-2016-0055.html |  | nvd |
|  |  | http://rhn.redhat.com/errata/RHSA-2016-0056.html |  | nvd |
|  |  | http://rhn.redhat.com/errata/RHSA-2016-0057.html |  | nvd |
|  |  | http://www.debian.org/security/2015/dsa-3399 |  | nvd |
|  |  | http://www.debian.org/security/2016/dsa-3507 |  | nvd |
|  |  | http://www.openwall.com/lists/oss-security/2015/11/12/2 |  | nvd |
|  |  | http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html |  | nvd |
|  |  | http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html |  | nvd |
|  |  | http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html |  | nvd |
|  |  | http://www.securityfocus.com/bid/77568 |  | nvd |
|  |  | http://www.securitytracker.com/id/1034142 |  | nvd |
|  |  | http://www.ubuntu.com/usn/USN-2815-1 |  | nvd |
|  |  | https://access.redhat.com/errata/RHSA-2016:1430 |  | nvd |
|  |  | https://code.google.com/p/chromium/issues/detail?id=560291 |  | nvd |
|  |  | https://kc.mcafee.com/corporate/index?page=content&id=SB10148 |  | nvd |
|  |  | https://security.gentoo.org/glsa/201603-09 |  | nvd |
|  |  | https://security.gentoo.org/glsa/201611-08 |  | nvd |
|  |  | https://support.apple.com/HT206167 |  | nvd |
| chromium-browser |  | https://github.com/glennrp/libpng/commit/475bab6170f651b9863e9fc1b8ffd6cd89a45aa0 |  | ubuntu |
| chromium-browser |  | https://github.com/glennrp/libpng/commit/3939689e7d9d06ee05411210bc8e605adcff294e |  | ubuntu |
| chromium-browser |  | https://github.com/glennrp/libpng/commit/216dbf7f7eef5d999f2e3ba054407917098e9f85 |  | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    1.0.64之前的1.0.x、1.2.54之前的1.2.x、1.3.x、1.4.17之前的1.4.x、1.5.24之前的l.5.x和1.6.19之前的1.6.x ，libpng的png_set_PLTE和png_get_PLTE函数存在多个缓冲区溢出，远程攻击者可通过PNG中的 IHDR（又名图像标头）块中的小位深度值造成拒绝服务或其他未知影响。 
 openEuler评分：
  7.5
 Vector：CVSS：2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
 受影响版本排查(受影响/不受影响)：
  1.master(6.04):受影响
2.openEuler-20.03-LTS-SP4(6.04):受影响
3.openEuler-22.03-LTS-SP1(6.04):受影响
4.openEuler-22.03-LTS-SP3(6.04):受影响
5.openEuler-22.03-LTS-SP4(6.04):受影响
6.openEuler-24.03-LTS(6.04):受影响
7.openEuler-24.03-LTS-Next(6.04):受影响

修复是否涉及abi变化(是/否)：
  1.master(6.04):否
2.openEuler-20.03-LTS-SP4(6.04):否
3.openEuler-22.03-LTS-SP1(6.04):否
4.openEuler-22.03-LTS-SP3(6.04):否
5.openEuler-22.03-LTS-SP4(6.04):否
6.openEuler-24.03-LTS(6.04):否
7.openEuler-24.03-LTS-Next(6.04):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2091

src-openEuler/syslinux

Content Risk Flag

Comments (11)

src-openEuler/syslinux .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2015-8126

Comments (11)

Search

src-openEuler/syslinux