CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3857
https://notcve.org/view.php?id=CVE-2022-3857
A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and denial of service in png_setup_paeth_row() function. • https://security.netapp.com/advisory/ntap-20230406-0004 https://sourceforge.net/p/libpng/bugs/300 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 2CVE-2021-4214
https://notcve.org/view.php?id=CVE-2021-4214
A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service. Se ha encontrado un fallo de desbordamiento de la pila en el programa pngimage.c de libpngs. Este fallo permite a un atacante con acceso a la red local pasar un archivo PNG especialmente diseñado a la utilidad pngimage, causando un fallo en la aplicación, conllevando a una denegación de servicio. • https://access.redhat.com/security/cve/CVE-2021-4214 https://bugzilla.redhat.com/show_bug.cgi?id=2043393 https://github.com/glennrp/libpng/issues/302 https://security-tracker.debian.org/tracker/CVE-2021-4214 https://security.netapp.com/advisory/ntap-20221020-0001 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-35511
https://notcve.org/view.php?id=CVE-2020-35511
A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file. Se ha detectado un desbordamiento de búfer global en la función pngcheck en pngcheck versión 2.4.0 (5 parches aplicados) por medio de un archivo png diseñado. • http://www.libpng.org/pub/png/apps/pngcheck.html https://lists.debian.org/debian-lts-announce/2022/12/msg00024.html https://www.debian.org/security/2022/dsa-5300 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-126: Buffer Over-read •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2020-27818
https://notcve.org/view.php?id=CVE-2020-27818
A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temporary denial of service, posing a low risk to application availability. Se encontró un fallo en la función check_chunk_name() de pngcheck-2.4.0. Un atacante capaz de pasar un archivo malicioso para ser procesado por pngcheck podría causar una denegación temporal de servicio, lo que supone un bajo riesgo para la disponibilidad de la aplicación. • https://bodhi.fedoraproject.org/updates/FEDORA-2020-04d5e1ce26 https://bodhi.fedoraproject.org/updates/FEDORA-2020-23432b7b72 https://bodhi.fedoraproject.org/updates/FEDORA-2020-27b168926a https://bodhi.fedoraproject.org/updates/FEDORA-2020-4349e95c4f https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-339db397ad https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-6c93c61069 https://bugzilla.redhat.com/show_bug.cgi?id=1902011 https://lists.debian.org/debian-lts-announce/2022/05/msg00043.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 0CVE-2017-12652 – libpng: does not check length of chunks against user limit
https://notcve.org/view.php?id=CVE-2017-12652
libpng before 1.6.32 does not properly check the length of chunks against the user limit. En libpng anterior a versión 1.6.32, no comprueba apropiadamente la longitud de fragmentos en comparación con el límite del usuario. • http://www.securityfocus.com/bid/109269 https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE https://security.netapp.com/advisory/ntap-20220506-0003 https://support.f5.com/csp/article/K88124225 https://support.f5.com/csp/article/K88124225?utm_source=f5support&%3Butm_medium=RSS https://access.redhat.com/security/cve/CVE-2017-12652 https://bugzilla.redhat.com/show_bug.cgi?id=1733956 • CWE-20: Improper Input Validation •