[vuxml] graphics/optipng: document CVE-2008-5101

Sat Nov 22 12:01:40 PST 2008

>Submitter-Id:	current-users
>Originator:	Eygene Ryabinkin
>Organization:	Code Labs
>Confidential:	no 
>Synopsis:	[vuxml] graphics/optipng: document CVE-2008-5101
>Severity:	serious
>Priority:	high
>Category:	ports
>Class:		sw-bug
>Release:	FreeBSD 7.1-PRERELEASE i386
>Environment:

System: FreeBSD 7.1-PRERELEASE i386

>Description:

Buffer overflow in the OptiPNG BMP file handling was discovered.  The
code in question exists even in the 0.5.4, so, while it is questionable
if such an old version can be attacked with the original exploit, I
think that 0.5.4 has this vulnerability too.  Have no direct evidence
though.

>How-To-Repeat:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5101
http://secunia.com/advisories/32651

>Fix:

The following VuXML entry should be evaluated and added:
--- vuln.xml begins here ---
  <vuln vid="">
    <topic>optipng -- arbitrary code execution via crafted BMP image</topic>
    <affects>
      <package>
	<name>optipng</name>
	<range><lt>1.6.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Secunia reports:</p>
	<blockquote cite="http://secunia.com/advisories/32651">
	<p>A vulnerability has been reported in OptiPNG, which
	potentially can be exploited by malicious people to compromise
	a user's system.</p>
	<p>The vulnerability is caused due to a boundary error in
	the BMP reader and can be exploited to cause a buffer
	overflow by tricking a user into processing a specially
	crafted file.</p>
	<p>Successful exploitation may allow execution of arbitrary
	code.</p>
	<p>The vulnerability is reported in versions prior to 0.6.2.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2008-5101</cvename>
      <url>http://secunia.com/advisories/32651</url>
      <url>http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399</url>
      <url>http://optipng.sourceforge.net/</url>
    </references>
    <dates>
      <discovery>2008-11-11</discovery>
    </dates>
  </vuln>
--- vuln.xml ends here ---

Please, note that there is PR ports/128877 that updates port to 0.6.2
and this version isn't vulnerable.  I feel that the PR severity can be
raised due to the found vulnerability.