CVE-2006-5793

libpng DoS

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.

El trozo de sPLT manejador de código (la función png_set_sPLT en pngset.c) en libpng 1.0.6 hasta la 1.2.12 usa un operador de sizeof sobre un tipo de datos erroneo, lo cual permite a un atacante dependiente del contexto provocar denegación de servicio (caida) a través de trozos de sPLT mal formador que disparan una lectura fuera del limite.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2006-11-08 CVE Reserved
2006-11-17 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (45)

URL	Tag	Source
http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html	X_refsource_confirm
http://docs.info.apple.com/article.html?artnum=307562	X_refsource_confirm
http://securitytracker.com/id?1017244	Vdb Entry
http://support.avaya.com/elmodocs2/security/ASA-2007-254.htm	X_refsource_confirm
http://www.coresecurity.com/?action=item&id=2148	X_refsource_misc
http://www.securityfocus.com/archive/1/451874/100/200/threaded	Mailing List
http://www.securityfocus.com/archive/1/453484/100/100/threaded	Mailing List
http://www.securityfocus.com/archive/1/489135/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/21078	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/30290	Vdb Entry
https://issues.rpath.com/browse/RPL-824	X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10324	Signature

URL	Date	SRC

URL	Date	SRC
http://bugs.gentoo.org/attachment.cgi?id=101400&action=view	2018-10-17
http://bugs.gentoo.org/show_bug.cgi?id=154380	2018-10-17
http://secunia.com/advisories/22889	2018-10-17
http://secunia.com/advisories/22900	2018-10-17
http://secunia.com/advisories/22956	2018-10-17
http://secunia.com/advisories/22958	2018-10-17
http://security.gentoo.org/glsa/glsa-200611-09.xml	2018-10-17
http://sourceforge.net/project/shownotes.php?release_id=464278	2018-10-17
http://www.ubuntu.com/usn/usn-383-1	2018-10-17
https://issues.rpath.com/browse/RPL-790	2018-10-17

URL	Date	SRC
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html	2018-10-17
http://secunia.com/advisories/22941	2018-10-17
http://secunia.com/advisories/22950	2018-10-17
http://secunia.com/advisories/22951	2018-10-17
http://secunia.com/advisories/23208	2018-10-17
http://secunia.com/advisories/23335	2018-10-17
http://secunia.com/advisories/25329	2018-10-17
http://secunia.com/advisories/25742	2018-10-17
http://secunia.com/advisories/29420	2018-10-17
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.465035	2018-10-17
http://www.mandriva.com/security/advisories?name=MDKSA-2006:209	2018-10-17
http://www.mandriva.com/security/advisories?name=MDKSA-2006:210	2018-10-17
http://www.mandriva.com/security/advisories?name=MDKSA-2006:211	2018-10-17
http://www.mandriva.com/security/advisories?name=MDKSA-2006:212	2018-10-17
http://www.novell.com/linux/security/advisories/2006_28_sr.html	2018-10-17
http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.036.html	2018-10-17
http://www.redhat.com/support/errata/RHSA-2007-0356.html	2018-10-17
http://www.trustix.org/errata/2006/0065	2018-10-17
http://www.vupen.com/english/advisories/2006/4521	2018-10-17
http://www.vupen.com/english/advisories/2006/4568	2018-10-17
http://www.vupen.com/english/advisories/2008/0924/references	2018-10-17
https://access.redhat.com/security/cve/CVE-2006-5793	2007-05-17
https://bugzilla.redhat.com/show_bug.cgi?id=215405	2007-05-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.0.6 Search vendor "Greg Roelofs" for product "Libpng" and version "1.0.6"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.0.7 Search vendor "Greg Roelofs" for product "Libpng" and version "1.0.7"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.0.8 Search vendor "Greg Roelofs" for product "Libpng" and version "1.0.8"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.0.9 Search vendor "Greg Roelofs" for product "Libpng" and version "1.0.9"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.0 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.0"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.1 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.1"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.2 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.2"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.3 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.3"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.4 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.4"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.5 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.5"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.6 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.6"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.7 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.7"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.7rc1 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.7rc1"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.8 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.8"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.9 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.9"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.10 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.10"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.11 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.11"		-		Affected
Greg Roelofs Search vendor "Greg Roelofs"		Libpng Search vendor "Greg Roelofs" for product "Libpng"				1.2.12 Search vendor "Greg Roelofs" for product "Libpng" and version "1.2.12"		-		Affected