CVE-2016-10087

What it actually does

The png_set_text_2 function in libpng allows a NULL pointer dereference when a text chunk is loaded into a png structure, removed, and then another text chunk is added, resulting in application crash.

Why it matters to the business

Antivirus scanning services may become unavailable when processing specially crafted image files, interrupting malware detection workflows and requiring restarts or failover.

How an attack unfolds

An attacker crafts a PNG image containing specific text chunks that trigger the sequence of load, remove, and add operations in libpng used by ClamAV; the file is submitted to a ClamAV scanner, causing a crash and denial of service.

How to fix it

Upgrade affected ClamAV packages to the listed fixed versions: 0.99.2+dfsg-1 on Debian 11/12/13/14, 0.99.2+addedllvm-0ubuntu0.14.04.1 on Ubuntu 14.04 LTS, and 0.99.2+dfsg-0ubuntu0.16.04.1 on Ubuntu 16.04 LTS. Rebuild any custom packages that statically link the vulnerable libpng.

How to confirm the fix worked

Verify installed ClamAV versions match the fixed releases above; test scanning a known non-malicious PNG before and after upgrade to confirm stability; monitor for absence of crashes on PNG processing.

Typical attack path

1. Craft malicious PNG with targeted text chunk sequence
2. Deliver PNG to target via email, download, or file share
3. Trigger ClamAV scan of the PNG file
4. Induce NULL pointer dereference and crash

How to detect it

Review ClamAV process logs and system crash dumps for segmentation faults or NULL dereference errors during PNG file handling; correlate with file access timestamps of PNGs submitted to the scanner.

What your security team should do

• Prioritize patching all listed ClamAV deployments within standard change windows
• Enable automatic updates for ClamAV where possible
• Add PNG file scanning to regression tests after upgrades