{
  "threat_severity" : "Low",
  "public_date" : "2015-10-22T00:00:00Z",
  "bugzilla" : {
    "description" : "libpng: Out-of-bounds read in png_convert_to_rfc1123",
    "id" : "1276416",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1276416"
  },
  "cvss" : {
    "cvss_base_score" : "4.0",
    "cvss_scoring_vector" : "AV:N/AC:L/Au:S/C:P/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-125",
  "details" : [ "The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.", "An array-indexing error was discovered in the png_convert_to_rfc1123() function of libpng. An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 5 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0100",
    "cpe" : "cpe:/a:redhat:rhel_extras:5",
    "package" : "java-1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0101",
    "cpe" : "cpe:/a:redhat:rhel_extras:5",
    "package" : "java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2015-12-09T00:00:00Z",
    "advisory" : "RHSA-2015:2594",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "libpng-2:1.2.49-2.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0099",
    "cpe" : "cpe:/a:redhat:rhel_extras:6",
    "package" : "java-1.7.1-ibm-1:1.7.1.3.30-1jpp.2.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0101",
    "cpe" : "cpe:/a:redhat:rhel_extras:6",
    "package" : "java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2015-12-09T00:00:00Z",
    "advisory" : "RHSA-2015:2595",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "libpng12-0:1.2.50-7.el7_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Supplementary",
    "release_date" : "2016-02-02T00:00:00Z",
    "advisory" : "RHSA-2016:0099",
    "cpe" : "cpe:/a:redhat:rhel_extras:7",
    "package" : "java-1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7"
  }, {
    "product_name" : "Red Hat Satellite 5.6",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.6::el5",
    "package" : "java-1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5"
  }, {
    "product_name" : "Red Hat Satellite 5.6",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.6::el5",
    "package" : "java-1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7"
  }, {
    "product_name" : "Red Hat Satellite 5.6",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.6::el5",
    "package" : "spacewalk-java-0:2.0.2-109.el5sat"
  }, {
    "product_name" : "Red Hat Satellite 5.7",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.7::el6",
    "package" : "java-1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7"
  }, {
    "product_name" : "Red Hat Satellite 5.7",
    "release_date" : "2016-07-18T00:00:00Z",
    "advisory" : "RHSA-2016:1430",
    "cpe" : "cpe:/a:redhat:network_satellite:5.7::el6",
    "package" : "spacewalk-java-0:2.3.8-146.el6sat"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 4",
    "fix_state" : "Will not fix",
    "package_name" : "libpng",
    "cpe" : "cpe:/o:redhat:enterprise_linux:4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 4",
    "fix_state" : "Will not fix",
    "package_name" : "libpng10",
    "cpe" : "cpe:/o:redhat:enterprise_linux:4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Will not fix",
    "package_name" : "libpng",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "libpng",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2015-7981\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-7981" ],
  "name" : "CVE-2015-7981",
  "csaw" : false
}