Published: 23/11/2004 Updated: 12/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Multiple buffer overflows in libpng 1.2.5 and previous versions, as used in multiple products, allow remote malicious users to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows messenger 5.0
greg roelofs libpng
microsoft msn messenger 6.1
microsoft msn messenger 6.2
microsoft windows media player 9
microsoft windows 98se
microsoft windows me

Synopsis mozilla security update Type/Severity Security Advisory: Critical Topic Updated mozilla packages based on version 143 that fix a number ofsecurity issues for Red Hat Enterprise Linux are now available Description Mozilla is an open source Web browser, advanced email and newsgrou ...

Synopsis libpng security update Type/Severity Security Advisory: Critical Topic Updated libpng packages that fix several issues are now available Description The libpng package contains a library of functions for creating andmanipulating PNG (Portable Network Graphics) image format filesD ...

Chris Evans discovered several vulnerabilities in libpng: CAN-2004-0597 Multiple buffer overflows exist, including when handling transparency chunk data, which could be exploited to cause arbitrary code to be executed when a specially crafted PNG image is processed CAN-2004-0598 Multiple NULL pointer dereferences in png_handle_iCPP() and els ...

#include <stdioh> #include <stdlibh> #include "pngh" /* The png_jmpbuf() macro, used in error handling, became available in * libpng version 106 If you want to be able to run your code with older * versions of libpng, you must define the macro yourself (but only if it * is not already defined by libpng!) */ #i ...

/* * exploit for libpng, tested on version 125 * infamous42md AT hotpop DOT com * * shouts to mitakeet (hope u patched :D) * * [n00b_at_localhoouternet] /po * Usage: /po < retaddr > [ outfile ] * * -all u need to give is retaddr, the default file it creates is controlled by * the define below, or u can pass a diff out ...

source: wwwsecurityfocuscom/bid/12506/info A remotely exploitable buffer overflow exists in MSN Messenger and Windows Messenger This vulnerability is related to parsing of Portable Network Graphics (PNG) image header data Successful exploitation will result in execution of arbitrary code in the context of the vulnerable client user At ...

Защищая C++ Источники CVE 100K: By The Numbers - blog An Empirical Study of C++ Vulnerabilities in Crowd-Sourced Code Examples - whitepaper Introduction To Software Exploits - site C and C++ vulnerability exploits and countermeasures - slides NIST Test Suites - site wwwexploit-dbcom libpng CVE wwwcvedetailscom/cve/CVE-2004-0597/ vulm

Introductory presentation on stack-based buffer overflows

From Crashes to Exploits or how to hack libpng This is a presentation that we developed (aimed at undergraduate students) on taking a crash found by AFL, debugging it and turning it into a working exploit It is a very introductory look at exploit development and focuses on the most simplest of buffer overflows However, it is based on real vulnerability: CVE-2004-0597 Wha

NVD-CWE-Other http://www.us-cert.gov/cas/techalerts/TA04-217A.html http://www.debian.org/security/2004/dsa-536 http://www.securityfocus.com/bid/10857 http://scary.beasts.org/security/CESA-2004-001.txt http://lists.apple.com/mhonarc/security-announce/msg00056.html http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml http://www.redhat.com/support/errata/RHSA-2004-402.html http://www.redhat.com/support/errata/RHSA-2004-421.html http://www.redhat.com/support/errata/RHSA-2004-429.html http://www.novell.com/linux/security/advisories/2004_23_libpng.html http://www.trustix.net/errata/2004/0040/http://www.mozilla.org/projects/security/known-vulnerabilities.html http://www.adobe.com/support/downloads/detail.jsp?ftpID=2679 http://www.us-cert.gov/cas/techalerts/TA05-039A.html http://www.kb.cert.org/vuls/id/388984 http://www.kb.cert.org/vuls/id/817368 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt http://www.securityfocus.com/bid/15495 http://www.coresecurity.com/common/showdoc.php?idx=421&idxseccion=10 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856 http://secunia.com/advisories/22957 http://secunia.com/advisories/22958 http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-114816-02-1 http://www.mandriva.com/security/advisories?name=MDKSA-2004:079 http://www.mandriva.com/security/advisories?name=MDKSA-2006:212 http://www.mandriva.com/security/advisories?name=MDKSA-2006:213 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1 https://bugzilla.fedora.us/show_bug.cgi?id=1943 http://marc.info/?l=bugtraq&m=109163866717909&w=2 http://marc.info/?l=bugtraq&m=109761239318458&w=2 http://marc.info/?l=bugtraq&m=109181639602978&w=2 http://marc.info/?l=bugtraq&m=109900315219363&w=2 http://marc.info/?l=bugtraq&m=110796779903455&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/16894 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7709 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A594 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4492 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2378 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2274 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11284 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-009 https://access.redhat.com/errata/RHSA-2004:421 https://nvd.nist.gov https://github.com/DSTCyber/from-crashes-to-exploits https://www.exploit-db.com/exploits/393/https://www.kb.cert.org/vuls/id/388984

CVE-2004-0597

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect