CVSS: 2.6EPSS: 4%CPEs: 1EXPL: 1CVE-2011-3328
https://notcve.org/view.php?id=CVE-2011-3328
The png_handle_cHRM function in pngrutil.c in libpng 1.5.4, when color-correction support is enabled, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed PNG image containing a cHRM chunk associated with a certain zero value. La función png_handle_cHRM en pngrutil.c en libpng 1.5.4, cuando está habilitado el soporte de corrección de color, permite a un atacante remoto causar una denegación de servicio (error de división por cero y bloqueo de aplicación) a través de una imagen PNG con formato erróneo que contiene un fragmento cHRM asociado con un determinado valor cero. • http://libpng.org/pub/png/libpng.html http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://lists.apple.com/archives/security-announce/2012/May/msg00001.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://sourceforge.net/tracker/index.php?func=detail&aid=3406145&group_id=5624&atid=105624 http://support.apple.com/kb/HT5130 http://support.apple.com/kb/HT5281 http://support.apple.com/kb/HT5503 http://www.kb.cert.org& •
CVSS: 2.6EPSS: 3%CPEs: 18EXPL: 0CVE-2006-5793 – libpng DoS
https://notcve.org/view.php?id=CVE-2006-5793
The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read. El trozo de sPLT manejador de código (la función png_set_sPLT en pngset.c) en libpng 1.0.6 hasta la 1.2.12 usa un operador de sizeof sobre un tipo de datos erroneo, lo cual permite a un atacante dependiente del contexto provocar denegación de servicio (caida) a través de trozos de sPLT mal formador que disparan una lectura fuera del limite. • http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html http://bugs.gentoo.org/attachment.cgi?id=101400&action=view http://bugs.gentoo.org/show_bug.cgi?id=154380 http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://secunia.com/advisories/22889 http://secunia.com/advisories/22900 http://secunia.com/advisories/22941 http://secunia.com/advisories/22950 http://secunia.c • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 2%CPEs: 13EXPL: 0CVE-2006-3334
https://notcve.org/view.php?id=CVE-2006-3334
Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to "chunk error processing," possibly involving the "chunk_name". Desbordamiento de búfer en la función png_decompress_chunk en pngrutil.c en libpng anteriores a v1.2.12 permite a los atacantes dependientes de contexto causar una denegación de servicios y posiblemente ejecutar arbitrariamente código a través de vectores no especificado en relación a "error de procesamiento", posiblemente relacionados con "chunk_name" • http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://secunia.com/advisories/20960 http://secunia.com/advisories/22956 http://secunia.com/advisories/22957 http://secunia.com/advisories/22958 http://secunia.com/advisories/23335 http://secunia.com/advisories/29420 http://secunia.com/advisories/33137 http://security.gentoo.org/glsa/glsa-200607-06.xml http://security.gentoo.org/glsa/glsa-200812-15.x •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 0CVE-2006-0481
https://notcve.org/view.php?id=CVE-2006-0481
Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler function is used to strip alpha channels out of the image. • ftp://ftp.simplesystems.org/pub/libpng/png/src/libpng-1.2.8-README.txt http://secunia.com/advisories/18654 http://secunia.com/advisories/18863 http://secunia.com/advisories/33137 http://security.gentoo.org/glsa/glsa-200812-15.xml http://securitytracker.com/id?1015615 http://securitytracker.com/id?1015617 http://www.redhat.com/support/errata/RHSA-2006-0205.html http://www.securityfocus.com/bid/16626 http://www.vupen.com/english/advisories/2006/0393 https://bugzilla.r • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 96%CPEs: 7EXPL: 5CVE-2004-0597 – LibPNG 1.2.5 - 'png_jmpbuf()' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2004-0597
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking. • https://www.exploit-db.com/exploits/393 https://www.exploit-db.com/exploits/389 https://www.exploit-db.com/exploits/25094 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856 http://lists.apple.com/mhonarc/security-announce/msg00056.html http://marc.info/?l=bugtraq&m=109163866717909&w=2 http://marc.info/?l=bugtraq&m=109181639602978&w=2 http://marc.info/?l=bugtraq&m=1097612393 •