リモートホストは、セキュリティ更新 2010-007 を適用していないバージョンの Mac OS X 10.5 を実行しています。

このセキュリティ更新には以下の製品の修正が含まれます：

- AFP サーバー
 - Apache mod_perl
 - ATS
 - CFNetwork
 - CoreGraphics
 - CoreText
 - CUPS
 - ディレクトリサービス
 - diskdev_cmds
 - ディスクイメージ
 - Flash Player プラグイン
 - gzip
 - ImageIO
 - Image RAW
 - MySQL
 - パスワードサーバー
 - PHP
 - プリンティング
 - python
 - QuickLook
 - Safari RSS
 - Wiki サーバー
 - X11

A vulnerability has been found and corrected in libpng :

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a decompression bomb attack (CVE-2010-0205).

The updated packages have been patched to correct this issue.

Denial of service while decompressing a highly compressed huge ancillary chunk has been fixed in libpng. CVE-2010-0205 has been assigned.

This is the latest upstream maintenance release. In addition to a number of minor bugfixes, it mitigates the resource-consumption effects of highly compressed ancillary chunks in hostile PNG files as described at http://libpng.sourceforge.net/ADVISORY-1.4.1.html This issue has been assigned CVE-2010-0205 by CERT.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to libpng 1.2.43, includes fix for CVE-2010-0205

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Denial of service while decompressing a highly compressed huge ancillary chunk has been fixed in libpng. (CVE-2010-0205)

Several vulnerabilities have been discovered in libpng, a library for reading and writing PNG files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2042     libpng does not properly parse 1-bit interlaced images     with width values that are not divisible by 8, which     causes libpng to include uninitialized bits in certain     rows of a PNG file and might allow remote attackers to     read portions of sensitive memory via 'out-of-bounds     pixels' in the file.

  - CVE-2010-0205     libpng does not properly handle compressed     ancillary-chunk data that has a disproportionately large     uncompressed representation, which allows remote     attackers to cause a denial of service (memory and CPU     consumption, and application hang) via a crafted PNG     file

Updated libpng and libpng10 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A memory corruption flaw was found in the way applications, using the libpng library and its progressive reading method, decoded certain PNG images. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1205)

A denial of service flaw was found in the way applications using the libpng library decoded PNG images that have certain, highly compressed ancillary chunks. An attacker could create a specially crafted PNG image that could cause an application using libpng to consume excessive amounts of memory and CPU time, and possibly crash.
(CVE-2010-0205)

A memory leak flaw was found in the way applications using the libpng library decoded PNG images that use the Physical Scale (sCAL) extension. An attacker could create a specially crafted PNG image that could cause an application using libpng to exhaust all available memory and possibly crash or exit. (CVE-2010-2249)

A sensitive information disclosure flaw was found in the way applications using the libpng library processed 1-bit interlaced PNG images. An attacker could create a specially crafted PNG image that could cause an application using libpng to disclose uninitialized memory. (CVE-2009-2042)

Users of libpng and libpng10 should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using libpng or libpng10 must be restarted for the update to take effect.

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-007 applied. 

This security update contains fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - ImageIO
  - Image RAW
  - MySQL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - Safari RSS
  - Wiki Server
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

ID	名前	製品	ファミリー	公開日	更新日	深刻度
50549	Mac OS X 複数の脆弱性（セキュリティ更新 2010-007）	Nessus	MacOS X Local Security Checks	2010/11/10	2024/5/28	critical
45136	Mandriva Linux Security Advisory : libpng (MDVSA-2010:064)	Nessus	Mandriva Local Security Checks	2010/3/24	2021/1/6	high
46247	SuSE9 Security Update : libpng (YOU Patch Number 12599)	Nessus	SuSE Local Security Checks	2010/5/7	2021/1/14	high
46357	openSUSE Security Update : libpng-devel (openSUSE-SU-2010:0257-1)	Nessus	SuSE Local Security Checks	2010/5/18	2021/1/14	high
47298	Fedora 13 : libpng10-1.0.53-1.fc13 (2010-2988)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	high
47310	Fedora 12 : libpng10-1.0.53-1.fc12 (2010-3375)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	high
47368	Fedora 12 : libpng-1.2.43-1.fc12 (2010-4673)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	high
51621	SuSE 11.1 Security Update : libpng12-0 (SAT Patch Number 2473)	Nessus	SuSE Local Security Checks	2011/1/21	2021/1/14	high
45480	Debian DSA-2032-1 : libpng - several vulnerabilities	Nessus	Debian Local Security Checks	2010/4/12	2021/1/4	high
47741	CentOS 3 / 4 / 5 : libpng / libpng10 (CESA-2010:0534)	Nessus	CentOS Local Security Checks	2010/7/16	2021/1/4	high
50549	Mac OS X Multiple Vulnerabilities (Security Update 2010-007)	Nessus	MacOS X Local Security Checks	2010/11/10	2024/5/28	critical
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2010/11/11	2019/3/6	critical

検出

プラグインの検索

critical

high

high

high

high

high

high

high

high

high

critical

critical