Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
4.3
CVSSv2

CVE-2010-0205

Published: 03/03/2010 Updated: 07/08/2020
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Subscribe to Libpng

Vulnerability Summary

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x prior to 1.0.53, 1.2.x prior to 1.2.43, and 1.4.x prior to 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote malicious users to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

libpng libpng

apple mac os x

fedoraproject fedora 11

fedoraproject fedora 12

fedoraproject fedora 13

opensuse opensuse 11.0

opensuse opensuse 11.1

opensuse opensuse 11.2

suse linux enterprise server 9

suse linux enterprise server 10

suse linux enterprise server 11

canonical ubuntu linux 6.06

canonical ubuntu linux 8.04

canonical ubuntu linux 8.10

canonical ubuntu linux 9.04

canonical ubuntu linux 9.10

debian debian linux 5.0

debian debian linux 6.0

Vendor Advisories

Ubuntu Security Notice: libpng vulnerabilities
It was discovered that libpng did not properly initialize memory when decoding certain 1-bit interlaced images If a user or automated system were tricked into processing crafted PNG images, an attacker could possibly use this flaw to read sensitive information stored in memory This issue only affected Ubuntu 606 LTS, 804 LTS, 810 and 904 (CV ...
Debian CVElist Bug Report Logs: libpng: CVE-2009-2042 "out-of-bounds pixels" vulnerability
Debian Bug report logs - #533676 libpng: CVE-2009-2042 "out-of-bounds pixels" vulnerability Package: libpng; Maintainer for libpng is Anibal Monsalve Salazar <anibal@debianorg>; Reported by: Michael S Gilbert <michaelsgilbert@gmailcom> Date: Fri, 19 Jun 2009 18:09:04 UTC Severity: serious Tags: security Found in ...
Debian CVElist Bug Report Logs: CVE-2010-0205 VU#576029 libpng stalls on highly compressed ancillary chunks
Debian Bug report logs - #572308 CVE-2010-0205 VU#576029 libpng stalls on highly compressed ancillary chunks Package: libpng; Maintainer for libpng is Anibal Monsalve Salazar <anibal@debianorg>; Reported by: Aníbal Monsalve Salazar <anibal@debianorg> Date: Wed, 3 Mar 2010 05:36:01 UTC Severity: serious Tags: secu ...
Debian Security Advisories: DSA-2032-1 libpng -- several vulnerabilities
Several vulnerabilities have been discovered in libpng, a library for reading and writing PNG files The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-2042 libpng does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bit ...

References

CWE-400http://libpng.sourceforge.net/decompression_bombs.htmlhttp://www.securityfocus.com/bid/38478http://libpng.sourceforge.net/ADVISORY-1.4.1.htmlhttp://www.kb.cert.org/vuls/id/576029http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037237.htmlhttp://www.vupen.com/english/advisories/2010/0637http://ubuntu.com/usn/usn-913-1http://www.vupen.com/english/advisories/2010/0626http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037355.htmlhttp://www.vupen.com/english/advisories/2010/0605http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037364.htmlhttp://secunia.com/advisories/38774http://www.vupen.com/english/advisories/2010/0517http://www.vupen.com/english/advisories/2010/0847http://secunia.com/advisories/39251http://www.debian.org/security/2010/dsa-2032http://osvdb.org/62670http://www.securitytracker.com/id?1023674http://www.mandriva.com/security/advisories?name=MDVSA-2010:063http://www.mandriva.com/security/advisories?name=MDVSA-2010:064http://www.vupen.com/english/advisories/2010/0667http://www.vupen.com/english/advisories/2010/0682http://www.vupen.com/english/advisories/2010/0686http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037607.htmlhttp://www.vupen.com/english/advisories/2010/1107http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlhttp://www.vupen.com/english/advisories/2010/2491http://www.vmware.com/security/advisories/VMSA-2010-0014.htmlhttp://secunia.com/advisories/41574http://lists.vmware.com/pipermail/security-announce/2010/000105.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://support.apple.com/kb/HT4435https://exchange.xforce.ibmcloud.com/vulnerabilities/56661https://usn.ubuntu.com/913-1/https://nvd.nist.govhttps://www.kb.cert.org/vuls/id/576029
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2006-4304CVE-2024-4240arbitrary CVE-2024-31601XSSCVE-2023-20198CVE-2024-4256CVE-2024-3342encryption
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook