libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Imageio | — | Apply OS X security update 2008-006Upgrade macOS to the latest version | Dec 16, 2011 | Apr 14, 2008 |
| Apple Osx X11 | — | Upgrade macOS to the latest version | Dec 16, 2011 | Apr 14, 2008 |
| Centos_linux | — | Upgrade libpngUpgrade libpng10-develUpgrade libpng-develUpgrade libpng10 | Dec 1, 2016 | Apr 14, 2008 |
| Freebsd | — | Upgrade png | Dec 10, 2025 | Apr 25, 2008 |
| Gentoo Linux | — | Upgrade kde-base/kdm.Upgrade net-misc/iputils.Upgrade media-gfx/povray.Upgrade x11-apps/xinit.Upgrade dev-libs/liblzw.Upgrade app-text/gv.Upgrade app-arch/gzip.Upgrade media-tv/dvbstreamer.Upgrade x11-misc/slim.Upgrade sys-devel/m4.Upgrade kde-base/kget.Upgrade sys-block/partimage.Upgrade sys-apps/pmount.Upgrade app-antivirus/bitdefender-console.Upgrade sys-apps/acl.Upgrade app-misc/beanstalkd.Upgrade net-ftp/lftp.Upgrade media-gfx/splashutils.Upgrade media-gfx/pngcrush.Upgrade dev-perl/perl-tk.Upgrade x11-libs/gtk+.Upgrade www-client/uzbl.Upgrade dev-lang/tk.Upgrade app-arch/ncompress.Upgrade sys-auth/pam_krb5.Upgrade net-mail/mlmmj.Upgrade dev-util/insight.Upgrade media-libs/libpng.Upgrade dev-util/sourcenav.Upgrade app-text/dvipng. | Oct 30, 2017 | Apr 14, 2008 |
| Oracle_linux | — | Upgrade libpngUpgrade libpng-devel | Oct 16, 2024 | Apr 14, 2008 |
| Suse | — | Upgrade libpng-devel-64bitUpgrade libpng12-0Upgrade libpng12-0-64bitUpgrade libpng-devel-32bitUpgrade libpng-32bitUpgrade libpng-x86Upgrade libpng-64bitUpgrade libpng-develUpgrade suse-releaseUpgrade libpng12-0-32bitUpgrade libpng | Feb 17, 2015 | Apr 14, 2008 |
| Ubuntu | — | Upgrade libpng12-0 | Nov 8, 2024 | Apr 14, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub