CVE-2004-0597

LibPNG 1.2.5 - 'png_jmpbuf()' Local Buffer Overflow

Severity Score

10.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.

*Credits: N/A

CVSS Scores

NISTv2 10.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2004-06-23 CVE Reserved
2004-08-05 CVE Published
2004-08-11 First Exploit
2024-08-08 CVE Updated
2024-08-20 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (47)

URL	Tag	Source
http://marc.info/?l=bugtraq&m=109163866717909&w=2	Mailing List
http://marc.info/?l=bugtraq&m=110796779903455&w=2	Mailing List
http://secunia.com/advisories/22957	Third Party Advisory
http://secunia.com/advisories/22958	Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-114816-02-1	X_refsource_confirm
http://www.coresecurity.com/common/showdoc.php?idx=421&idxseccion=10	X_refsource_misc
http://www.kb.cert.org/vuls/id/388984	Third Party Advisory
http://www.kb.cert.org/vuls/id/817368	Third Party Advisory
http://www.mozilla.org/projects/security/known-vulnerabilities.html	X_refsource_confirm
http://www.securityfocus.com/bid/15495	Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA04-217A.html	Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA05-039A.html	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16894	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11284	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2274	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2378	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4492	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A594	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7709	Signature

URL	Date	SRC
https://www.exploit-db.com/exploits/393	2004-08-13
https://www.exploit-db.com/exploits/389	2004-08-11
https://www.exploit-db.com/exploits/25094	2005-02-08
http://scary.beasts.org/security/CESA-2004-001.txt	2024-08-08
http://www.securityfocus.com/bid/10857	2024-08-08

URL	Date	SRC
http://www.adobe.com/support/downloads/detail.jsp?ftpID=2679	2018-10-12
http://www.debian.org/security/2004/dsa-536	2018-10-12
http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml	2018-10-12
http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml	2018-10-12
http://www.novell.com/linux/security/advisories/2004_23_libpng.html	2018-10-12
http://www.trustix.net/errata/2004/0040	2018-10-12

URL	Date	SRC
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt	2018-10-12
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856	2018-10-12
http://lists.apple.com/mhonarc/security-announce/msg00056.html	2018-10-12
http://marc.info/?l=bugtraq&m=109181639602978&w=2	2018-10-12
http://marc.info/?l=bugtraq&m=109761239318458&w=2	2018-10-12
http://marc.info/?l=bugtraq&m=109900315219363&w=2	2018-10-12
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1	2018-10-12
http://www.mandriva.com/security/advisories?name=MDKSA-2004:079	2018-10-12
http://www.mandriva.com/security/advisories?name=MDKSA-2006:212	2018-10-12
http://www.mandriva.com/security/advisories?name=MDKSA-2006:213	2018-10-12
http://www.redhat.com/support/errata/RHSA-2004-402.html	2018-10-12
http://www.redhat.com/support/errata/RHSA-2004-421.html	2018-10-12
http://www.redhat.com/support/errata/RHSA-2004-429.html	2018-10-12
https://bugzilla.fedora.us/show_bug.cgi?id=1943	2018-10-12
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-009	2018-10-12
https://access.redhat.com/security/cve/CVE-2004-0597	2004-08-18
https://bugzilla.redhat.com/show_bug.cgi?id=1617235	2004-08-18

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				<= 1.2.5 Search vendor "Greg Roelofs" for product "Libpng" and version " <= 1.2.5"		-		Affected
Microsoft Search vendor "Microsoft"		Msn Messenger Search vendor "Microsoft" for product "Msn Messenger"				6.1 Search vendor "Microsoft" for product "Msn Messenger" and version "6.1"		-		Affected
Microsoft Search vendor "Microsoft"		Msn Messenger Search vendor "Microsoft" for product "Msn Messenger"				6.2 Search vendor "Microsoft" for product "Msn Messenger" and version "6.2"		-		Affected
Microsoft Search vendor "Microsoft"		Windows Media Player Search vendor "Microsoft" for product "Windows Media Player"				9 Search vendor "Microsoft" for product "Windows Media Player" and version "9"		-		Affected
Microsoft Search vendor "Microsoft"		Windows Messenger Search vendor "Microsoft" for product "Windows Messenger"				5.0 Search vendor "Microsoft" for product "Windows Messenger" and version "5.0"		-		Affected
Microsoft Search vendor "Microsoft"		Windows 98se Search vendor "Microsoft" for product "Windows 98se"				*		-		Affected
Microsoft Search vendor "Microsoft"		Windows Me Search vendor "Microsoft" for product "Windows Me"				*		second_edition		Affected