{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die libpng ist die offizielle Referenzbibliothek f\u00fcr die Darstellung und Manipulation von Bilder im Portable Network Graphics (PNG) Format.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libpng ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0175 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2015/wid-sec-w-2023-0175.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0175 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0175"
      },
      {
        "category": "external",
        "summary": "Meldung auf der oss-security Mailing Liste vom 2015-12-11",
        "url": "http://seclists.org/oss-sec/2015/q4/469"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-2861-1 vom 2016-01-06",
        "url": "http://www.ubuntu.com/usn/usn-2861-1/"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-3443 vom 2016-01-14",
        "url": "https://www.debian.org/security/2016/dsa-3443"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2016:0776-1 vom 2016-03-15",
        "url": "https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00049.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2017:0860-1 vom 2017-03-30",
        "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20170860-1.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2017:0901-1 vom 2017-03-31",
        "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20170901-1.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2017:0950-1 vom 2017-04-07",
        "url": "https://www.suse.com/support/update/announcement/2017/suse-su-20170950-1.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2023-1904 vom 2023-01-23",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1904.html"
      },
      {
        "category": "external",
        "summary": "HCL Article KB0037996 vom 2024-08-30",
        "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0037996"
      }
    ],
    "source_lang": "en-US",
    "title": "libpng: Schwachstelle erm\u00f6glicht Denial of Service",
    "tracking": {
      "current_release_date": "2024-09-01T22:00:00.000+00:00",
      "generator": {
        "date": "2024-09-02T08:03:30.838+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2023-0175",
      "initial_release_date": "2015-12-13T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2015-12-13T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initial Release"
        },
        {
          "date": "2015-12-13T23:00:00.000+00:00",
          "number": "2",
          "summary": "Version nicht vorhanden"
        },
        {
          "date": "2015-12-13T23:00:00.000+00:00",
          "number": "3",
          "summary": "Version nicht vorhanden"
        },
        {
          "date": "2016-01-06T23:00:00.000+00:00",
          "number": "4",
          "summary": "New remediations available"
        },
        {
          "date": "2016-01-06T23:00:00.000+00:00",
          "number": "5",
          "summary": "Version nicht vorhanden"
        },
        {
          "date": "2016-01-13T23:00:00.000+00:00",
          "number": "6",
          "summary": "New remediations available"
        },
        {
          "date": "2016-01-13T23:00:00.000+00:00",
          "number": "7",
          "summary": "Version nicht vorhanden"
        },
        {
          "date": "2016-03-15T23:00:00.000+00:00",
          "number": "8",
          "summary": "New remediations available"
        },
        {
          "date": "2017-03-30T22:00:00.000+00:00",
          "number": "9",
          "summary": "New remediations available"
        },
        {
          "date": "2017-04-02T22:00:00.000+00:00",
          "number": "10",
          "summary": "New remediations available"
        },
        {
          "date": "2017-04-06T22:00:00.000+00:00",
          "number": "11",
          "summary": "New remediations available"
        },
        {
          "date": "2023-01-23T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-09-01T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von HCL aufgenommen"
        }
      ],
      "status": "final",
      "version": "13"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "HCL Notes",
            "product": {
              "name": "HCL Notes",
              "product_id": "T022546",
              "product_identification_helper": {
                "cpe": "cpe:/a:hcltech:notes:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "HCL"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.6.0",
                "product": {
                  "name": "Open Source libpng \u003c1.6.0",
                  "product_id": "228881"
                }
              },
              {
                "category": "product_version",
                "name": "1.6.0",
                "product": {
                  "name": "Open Source libpng 1.6.0",
                  "product_id": "228881-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:libpng:libpng:1.6.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.5.26",
                "product": {
                  "name": "Open Source libpng \u003c1.5.26",
                  "product_id": "T006627"
                }
              },
              {
                "category": "product_version",
                "name": "1.5.26",
                "product": {
                  "name": "Open Source libpng 1.5.26",
                  "product_id": "T006627-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:libpng:libpng:1.5.26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.4.19",
                "product": {
                  "name": "Open Source libpng \u003c1.4.19",
                  "product_id": "T006628"
                }
              },
              {
                "category": "product_version",
                "name": "1.4.19",
                "product": {
                  "name": "Open Source libpng 1.4.19",
                  "product_id": "T006628-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:libpng:libpng:1.4.19"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.2.56",
                "product": {
                  "name": "Open Source libpng \u003c1.2.56",
                  "product_id": "T006629"
                }
              },
              {
                "category": "product_version",
                "name": "1.2.56",
                "product": {
                  "name": "Open Source libpng 1.2.56",
                  "product_id": "T006629-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:libpng:libpng:1.2.56"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c1.0.66",
                "product": {
                  "name": "Open Source libpng \u003c1.0.66",
                  "product_id": "T006630"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.66",
                "product": {
                  "name": "Open Source libpng 1.0.66",
                  "product_id": "T006630-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:libpng:libpng:1.0.66"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "libpng"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in libpng in png_check_keyword in pngwutil.c. Ein Angreifer kann dies durch \u00dcbermitteln geeignet gestalteter Daten zu einem Underflow ausnutzen. In der Folge ist die Einsicht in vertrauliche Daten und ein Denial of Service Angriff m\u00f6glich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006630",
          "2951",
          "T002207",
          "228881",
          "T000126",
          "T022546",
          "T006627",
          "398363",
          "T006629",
          "T006628"
        ]
      },
      "release_date": "2015-12-13T23:00:00.000+00:00",
      "title": "CVE-2015-8540."
    }
  ]
}