CVSS: 5.0EPSS: 13%CPEs: 15EXPL: 1CVE-2013-6954 – libpng: unhandled zero-length PLTE chunk or NULL palette
https://notcve.org/view.php?id=CVE-2013-6954
The png_do_expand_palette function in libpng before 1.6.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE chunk of zero bytes or (2) a NULL palette, related to pngrtran.c and pngset.c. La función png_do_expand_palette en libpng anteriores a 1.6.8 permite a atacantes remotos causar una denegación de servicio (referencia a puntero NULO y crash de la aplicación) a través de (1) un chunk PLTE de cero bytes o (2) una paleta NULL, relacionada con pngrtran.c y pngset.c • http://advisories.mageia.org/MGASA-2014-0075.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127947.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127952.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128098.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128099.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128114.html http://lists.opensuse.org/opensuse-updates/2014-01/m •
CVSS: 4.3EPSS: 3%CPEs: 149EXPL: 0CVE-2012-3425
https://notcve.org/view.php?id=CVE-2012-3425
The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image. La función png_push_read_zTXt en pngpread.c en libpng v1.0.x antes de v1.0.58, v1.2.x antes de v1.2.48, v1.4.x antes de v1.4.10 y v1.5.x antes de v1.5.10 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de límites) a través de un valor demasiado grande en el campo avail_in en una imagen PNG. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668082 http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=blob%3Bf=CHANGES%3Bh=284de253b1561b976291ba7405acd71ae71ff597%3Bhb=refs/heads/libpng10 http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=blob%3Bf=CHANGES%3Bh=2da5a7a8b690e257f94353b5b49d493cdc385322%3Bhb=refs/heads/libpng14 http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=blob%3Bf=CHANGES%3Bh=73e2ffd6a1471f2144d0ce7165d7323cb109f10f%3Bhb=refs/heads/libpng15 http://libpng • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 5%CPEs: 143EXPL: 0CVE-2011-3048 – libpng: memory corruption flaw
https://notcve.org/view.php?id=CVE-2011-3048
The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow. La función png_set_text_2 en pngset.c en libpng v1.0.x anterior a v1.0.59, v1.2.x anterior a v1.2.49, v1.4.x anterior a v1.4.11, y v1.5.x anterior a v1.5.10 permite a atacantes remotos provocar una denegación de servicio (bloqueo) o ejecutar código arbitrario a través de un chunk de texto manipulado en un archivo de imagen PNG, provocando un error de asignación de memoria que no se manipula correctamente, dando lugar a un desbordamiento de búfer basado en memoria dinámica. • http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077007.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077043.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077472.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077819.html http://lists.fedoraproject.org/pipermail/package • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •