SB2016042404 - Multiple vulnerabilities in NVIDIA Linux device drivers for System x, Flex and BladeCenter Systems
Published: April 24, 2016 Updated: October 27, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2015-8472)
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
2) Information disclosure (CVE-ID: CVE-2015-7981)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.
3) Buffer overflow (CVE-ID: CVE-2015-8126)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Remediation
Install update from vendor's website.