<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for pngcheck</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2022:10142-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-10-05T22:01:48Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-10-05T22:01:48Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-10-05T22:01:48Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for pngcheck</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for pngcheck fixes the following issues:

version update to 3.0.3 [boo#1202662]

* fixed a crash bug (and probable vulnerability) in large (MNG) LOOP chunks
* fixed a divide-by-zero crash bug (and probable vulnerability)
  in interlaced images with extra compressed data beyond the
  nominal end of the image data (found by 'chiba of topsec alpha
  lab')

version update to 3.0.0

  * tweaked color definitions slightly to work better on terminals with white/light backgrounds
  * fixed DHDR (pre-MNG-1.0) bug identified by Winfried &lt;szukw000@arcor.de&gt;
  * added eXIf support (GRR: added check for II/MM/unknown format)
  * converted static const help/usage-related strings to macros so -Werror=format-security doesn't trigger (Ben Beasley)
  * added (help2man-generated) man pages for all three utils added top-level LICENSE file; fixed various compiler warnings
  * fixed buffer-overflow vulnerability discovered by 'giantbranch of NSFOCUS Security Team' *               https://bugzilla.redhat.com/show_bug.cgi?id=1897485
  * found and fixed four additional vulnerabilities (null-pointer dereference and three buffer overruns)
  * an off-by-one bug in check_magic() (Lucy Phipps)
  * converted two zlib-version warnings/errors to go to stderr (Lemures Lemniscati, actually from 20180318; forwarded by LP)
  * fixed another buffer-overflow vulnerability discovered by 'giantbranch of NSFOCUS Security Team' https://bugzilla.redhat.com/show_bug.cgi?id=1905775
  * removed -f ('force') option due to multiple security issues
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-2022-10142</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4HVZNA3VAYHKC5NXBYOOMUZSZNOXRCF7/</URL>
      <Description>E-Mail link for openSUSE-SU-2022:10142-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1202662</URL>
      <Description>SUSE Bug 1202662</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2020-35511/</URL>
      <Description>SUSE CVE CVE-2020-35511 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Package Hub 15 SP3">
      <Branch Type="Product Name" Name="SUSE Package Hub 15 SP3">
        <FullProductName ProductID="SUSE Package Hub 15 SP3">SUSE Package Hub 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.3">
      <Branch Type="Product Name" Name="openSUSE Leap 15.3">
        <FullProductName ProductID="openSUSE Leap 15.3" CPE="cpe:/o:opensuse:leap:15.3">openSUSE Leap 15.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="pngcheck-3.0.3-bp153.3.3.1">
      <FullProductName ProductID="pngcheck-3.0.3-bp153.3.3.1">pngcheck-3.0.3-bp153.3.3.1</FullProductName>
    </Branch>
    <Relationship ProductReference="pngcheck-3.0.3-bp153.3.3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15 SP3">
      <FullProductName ProductID="SUSE Package Hub 15 SP3:pngcheck-3.0.3-bp153.3.3.1">pngcheck-3.0.3-bp153.3.3.1 as a component of SUSE Package Hub 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="pngcheck-3.0.3-bp153.3.3.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:pngcheck-3.0.3-bp153.3.3.1">pngcheck-3.0.3-bp153.3.3.1 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.</Note>
    </Notes>
    <CVE>CVE-2020-35511</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 15 SP3:pngcheck-3.0.3-bp153.3.3.1</ProductID>
        <ProductID>openSUSE Leap 15.3:pngcheck-3.0.3-bp153.3.3.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV3>
        <BaseScoreV3>7.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4HVZNA3VAYHKC5NXBYOOMUZSZNOXRCF7/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2020-35511.html</URL>
        <Description>CVE-2020-35511</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1202662</URL>
        <Description>SUSE Bug 1202662</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
