The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libpng | Mar 31, 2017 | Aug 13, 2012 |
| Huawei Euleros 2_0_sp10 | — | Upgrade syslinuxUpgrade syslinux-nonlinux | Nov 11, 2024 | Aug 13, 2012 |
| Huawei Euleros 2_0_sp11 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Dec 12, 2024 | Aug 13, 2012 |
| Huawei Euleros 2_0_sp12 | — | Upgrade syslinuxUpgrade syslinux-nonlinux | Dec 12, 2024 | Aug 13, 2012 |
| Huawei Euleros 2_0_sp9 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Nov 11, 2024 | Aug 13, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 8, 2012 |
| Suse | — | Upgrade libpng12-0Upgrade libpng12-0-32bitUpgrade libpng-develUpgrade libpng12-0-x86Upgrade libpng-devel-32bit | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpng12-0 | Nov 23, 2015 | Aug 13, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub