{"action":"closed","issue":{"url":"https://api.github.com/repos/jowein/forever/issues/231","repository_url":"https://api.github.com/repos/jowein/forever","labels_url":"https://api.github.com/repos/jowein/forever/issues/231/labels{/name}","comments_url":"https://api.github.com/repos/jowein/forever/issues/231/comments","events_url":"https://api.github.com/repos/jowein/forever/issues/231/events","html_url":"https://github.com/jowein/forever/issues/231","id":365006624,"node_id":"MDU6SXNzdWUzNjUwMDY2MjQ=","number":231,"title":"CVE-2011-2692 Medium severity vulnerability detected by WhiteSource","user":{"login":"thunderalpha1[bot]","id":42357622,"node_id":"MDM6Qm90NDIzNTc2MjI=","avatar_url":"https://avatars1.githubusercontent.com/u/3177372?v=4","gravatar_id":"","url":"https://api.github.com/users/thunderalpha1%5Bbot%5D","html_url":"https://github.com/apps/thunderalpha1","followers_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/followers","following_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/repos","events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-28T19:07:21Z","updated_at":"2018-09-28T19:15:19Z","closed_at":"2018-09-28T19:15:19Z","author_association":"NONE","body":"## CVE-2011-2692 - Medium severity vulnerability\n<details><summary>:red_circle: Vulnerability Details</summary>\n<p>  \n  \nThe png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.\n\n<p>Publish Date: 2011-07-17\n<p>URL: <a href=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2692>CVE-2011-2692</a></p>\n</p>\n</details>\n<p></p>\n<details><summary>:dart: CVSS 2 Score Details (<b>4.3</b>)</summary>\n<p>\n\nBase Score Metrics not available</p>\n\n</p>\n</details>\n<p></p>\n<details><summary>:white_check_mark: Suggested Fix</summary>\n<p>\n\n<p>Type: Upgrade version</p>\n<p>Origin: <a href=\"https://security.gentoo.org/glsa/201206-15\">https://security.gentoo.org/glsa/201206-15</a></p>\n<p>Release Date: 2012-06-21</p>\n<p>Fix Resolution: All libpng 1.5 users should upgrade to the latest version >= libpng-1.5.10\nAll libpng 1.2 users should upgrade to the latest version >= libpng-1.2.49\n</p>\n\n</p>\n</details>\n<p></p>\n<details><summary>:warning: Vulnerable Library - <b>libpngv1.2.2</b></p></summary>\n<p>\n\n<p>Library home page: https://github.com/hunter-packages/libpng.git\n<p> * The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries. </p>\n\nLibrary Source Files:\n  - /forever/pngrutil.c\n<p>Found in commit: <a href=\"https://github.com/jowein/forever/commit/0f1d52ac306924d58c9b84ff85688648b68771d7\">0f1d52ac306924d58c9b84ff85688648b68771d7</a></p>\n</p>\n</details>\n<p></p>\n\n***\nStep up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)"}}
{"actor":{"display_login":"yoswein"}}