Executive brief
A security vulnerability exists in Libbpg, a software library used to decode BPG (Better Portable Graphics) images. By tricking a user into opening a specially crafted image file, an attacker could potentially take control of the affected system or cause the application to crash. This impact is significant for any software that uses this library to process user-provided images, such as media players or web-related tools.
Technical details
A heap-based out-of-bounds write vulnerability exists in Libbpg versions 0.9.4 and 0.9.7 within the restore_tqb_pixels function in libavcodec/hevc_filter.c. The flaw is caused by an integer underflow when calculating offsets for source and destination operands used in a memcpy operation. An attacker can trigger this by providing a specially crafted BPG image for decoding. Successful exploitation allows for arbitrary code execution in the context of the application using the library. A patch was proposed by Cisco Talos to adjust the calculation logic to prevent the underflow.
Affected products
- Libbpg project Libbpg 0.9.4, 0.9.7
Timeline
- 2016-10-20: disclosed: Vendor disclosure
- 2017-01-23: advisory: Public release by Cisco Talos
- 2017-01-26: other: NVD publication