{"id":149225,"date":"2025-11-22T11:12:02","date_gmt":"2025-11-22T09:12:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-libpng-privodyashhaya-k-perepolneniyu-bufera-pri-obrabotke-png-izobrazhenij"},"modified":"2025-11-22T11:12:02","modified_gmt":"2025-11-22T09:12:02","slug":"uyazvimost-v-libpng-privodyashhaya-k-perepolneniyu-bufera-pri-obrabotke-png-izobrazhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/uyazvimost-v-libpng-privodyashhaya-k-perepolneniyu-bufera-pri-obrabotke-png-izobrazhenij","title":{"rendered":"Sicherheitsanf\u00e4lligkeit in libpng, die zu einem Puffer\u00fcberlauf bei der Verarbeitung von PNG-Bildern f\u00fchrt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Im Korrekturrelease der Bibliothek libpng 1.6.51, die als direkte Abh\u00e4ngigkeit in etwa 600 Paketen in Ubuntu verwendet wird, wurden vier Sicherheitsanf\u00e4lligkeiten behoben. Eine davon (CVE-2025-65018) f\u00fchrt zu einem Schreiben au\u00dferhalb des Puffers. Diese Sicherheitsanf\u00e4lligkeit k\u00f6nnte potenziell die Ausf\u00fchrung eigenen Codes bei der Verarbeitung speziell gestalteter PNG-Dateien erm\u00f6glichen. <\/p>\n

Das Problem betrifft Anwendungen, die die vereinfachte API (png_image_finish_read) verwenden, und wird durch einen Fehler in der Funktion png_combine_row() verursacht. Die Sicherheitsanf\u00e4lligkeit tritt auf, wenn das 8-Bit RGBA-Ausgabeformat (PNG_FORMAT_RGBA) f\u00fcr Bilder mit einer 16-Bit Farbkanaldarstellung und zeilenweiser Kodierung (interlaced) verwendet wird. Der Puffer\u00fcberlauf entsteht durch den Versuch, Daten mit einer 16-Bit Farbkanaldarstellung in einen Puffer zu schreiben, dessen Gr\u00f6\u00dfe auf der Annahme basiert, dass 8-Bit pro Farbkanal verwendet wird. <\/p>\n

Die verbleibenden drei Schwachstellen (CVE-2025-64505, CVE-2025-64506, CVE-2025-64720) f\u00fchren zu Speicherleseoperationen au\u00dferhalb der Puffergrenzen und k\u00f6nnen genutzt werden, um einen Anwendungsabsturz zu verursachen oder das Auslaufen von Restdaten aus dem Prozessspeicher zu erm\u00f6glichen. <\/p>\n

Den Status der Behebung von Schwachstellen in verschiedenen Distributionen k\u00f6nnen Sie auf diesen Seiten einsehen (wenn die Seite nicht verf\u00fcgbar ist, bedeutet dies, dass die Entwickler der Distribution das Problem noch nicht begonnen haben zu pr\u00fcfen): Debian, Ubuntu, SUSE, RHEL, Arch, Fedora, FreeBSD.
\n
Quelle: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libpng 1.6.51, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u044f\u043c\u043e\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u043e\u043a\u043e\u043b\u043e 600 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 Ubuntu, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2025-65018) \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0443 \u0431\u0443\u0444\u0435\u0440\u0430. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PNG. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u0443\u043f\u0440\u043e\u0449\u0451\u043d\u043d\u044b\u0439 API (png_image_finish_read), \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-149225","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Schwachstelle in libpng, die zu einem Puffer\u00fcberlauf bei der Verarbeitung von PNG-Bildern f\u00fchrt | ProHoster","description":"Im korrigierenden Release der Bibliothek libpng 1.6.51, die als direkte Abh\u00e4ngigkeit in etwa 600 Paketen in Ubuntu verwendet wird, wurden vier Schwachstellen behoben, darunter eine (CVE-2025-65018), die zu einem Puffer\u00fcberlauf f\u00fchrt. Diese Schwachstelle k\u00f6nnte potenziell die Ausf\u00fchrung von eigenem Code bei der Verarbeitung speziell gestalteter PNG-Dateien erm\u00f6glichen. Das Problem betrifft Anwendungen, die die vereinfachte API (png_image_finish_read) verwenden, und wurde verursacht.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/uyazvimost-v-libpng-privodyashhaya-k-perepolneniyu-bufera-pri-obrabotke-png-izobrazhenij","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 libpng, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 PNG-\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u0412 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libpng 1.6.51, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u044f\u043c\u043e\u0439 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u0443 \u043e\u043a\u043e\u043b\u043e 600 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 Ubuntu, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2025-65018) \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u0443 \u0431\u0443\u0444\u0435\u0440\u0430. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 PNG. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 \u0443\u043f\u0440\u043e\u0449\u0451\u043d\u043d\u044b\u0439 API (png_image_finish_read), \u0438 \u0432\u044b\u0437\u0432\u0430\u043d\u0430","og:url":"https:\/\/prohoster.info\/de\/blog\/novosti-interneta\/uyazvimost-v-libpng-privodyashhaya-k-perepolneniyu-bufera-pri-obrabotke-png-izobrazhenij","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-11-22T09:12:02+00:00","article:modified_time":"2025-11-22T09:12:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"149225","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:10:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 16:10:19","updated":"2026-01-23 16:10:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/149225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=149225"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/149225\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=149225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=149225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=149225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}