CVE-2004-0597 Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function...
HighCVSS 10.0
EPSS 81.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| greg roelofs libpng | <= 1.2.5 | No fix listed |
| Microsoft msn messenger | = 6.1 | No fix listed |
| Microsoft msn messenger | = 6.2 | No fix listed |
| Microsoft windows media player | = 9 | No fix listed |
| Microsoft windows messenger | = 5.0 | No fix listed |
| Microsoft windows 98se | All versions | No fix listed |
| Microsoft windows me | All versions | No fix listed |
References
- CLA-2004:856 vendor-advisory
- APPLE-SA-2004-09-09 vendor-advisory
- 20040804 [OpenPKG-SA-2004.035] OpenPKG Security Advisory (png) mailing-list
- SSRT4778 vendor-advisory
- SCOSA-2004.16 vendor-advisory
- FLSA:2089 vendor-advisory
- 20050209 MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploit mailing-list
- scary.beasts.org exploit vendor-advisory
- 22957 third-party-advisory
- 22958 third-party-advisory
- 200663 vendor-advisory
- sunsolve.sun.com
- www.adobe.com patch
- www.coresecurity.com
- DSA-536 patch vendor-advisory
- GLSA-200408-03 patch vendor-advisory
- GLSA-200408-22 patch vendor-advisory
- VU#388984 third-party-advisory us-government-resource
- VU#817368 third-party-advisory us-government-resource
- MDKSA-2004:079 vendor-advisory
- MDKSA-2006:212 vendor-advisory
- MDKSA-2006:213 vendor-advisory
- www.mozilla.org
- SUSE-SA:2004:023 patch vendor-advisory
- RHSA-2004:402 vendor-advisory
- RHSA-2004:421 vendor-advisory
- RHSA-2004:429 vendor-advisory
- 10857 exploit patch vdb-entry vendor-advisory
- 15495 vdb-entry
- 2004-0040 patch vendor-advisory
- TA04-217A third-party-advisory us-government-resource
- TA05-039A third-party-advisory us-government-resource
- FLSA:1943 vendor-advisory
- MS05-009 vendor-advisory
- libpng-pnghandle-bo(16894) vdb-entry
- oval:org.mitre.oval:def:11284 signature vdb-entry
- oval:org.mitre.oval:def:2274 signature vdb-entry
- oval:org.mitre.oval:def:2378 signature vdb-entry
- oval:org.mitre.oval:def:4492 signature vdb-entry
- oval:org.mitre.oval:def:594 signature vdb-entry
- oval:org.mitre.oval:def:7709 signature vdb-entry