CVE-2007-2445 The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad...
MediumCVSS 5.0
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| png reference library libpng | <= 1.0.15 | No fix listed |
| png reference library libpng | <= 1.2.16 | No fix listed |
| debian/libgd2(Debian:12) | < 2.0.35.dfsg-1 | 2.0.35.dfsg-1 |
| debian/libgd2(Debian:13) | < 2.0.35.dfsg-1 | 2.0.35.dfsg-1 |
| debian/libgd2(Debian:14) | < 2.0.35.dfsg-1 | 2.0.35.dfsg-1 |
References
- android-developers.blogspot.com
- docs.info.apple.com
- irrlicht.sourceforge.net
- APPLE-SA-2008-03-18 vendor-advisory
- OpenPKG-SA-2007.013 vendor-advisory
- 36196 vdb-entry
- 25268 third-party-advisory vendor-advisory
- 25273 third-party-advisory vendor-advisory
- 25292 third-party-advisory vendor-advisory
- 25329 third-party-advisory vendor-advisory
- 25353 third-party-advisory
- 25461 third-party-advisory
- 25554 third-party-advisory
- 25571 third-party-advisory
- 25742 third-party-advisory
- 25787 third-party-advisory
- 25867 third-party-advisory
- 27056 third-party-advisory
- 29420 third-party-advisory
- 30161 third-party-advisory
- 31168 third-party-advisory
- 34388 third-party-advisory
- SSA:2007-136-01 vendor-advisory
- sourceforge.net patch
- sourceforge.net patch
- 102987 vendor-advisory
- 200871 vendor-advisory
- support.avaya.com
- www.coresecurity.com
- DSA-1613 vendor-advisory
- DSA-1750 vendor-advisory
- GLSA-200705-24 vendor-advisory
- GLSA-200805-07 vendor-advisory
- VU#684664 third-party-advisory us-government-resource
- MDKSA-2007:116 vendor-advisory
- www.mirrorservice.org vendor-advisory
- SUSE-SR:2007:013 vendor-advisory
- RHSA-2007:0356 vendor-advisory
- 20070517 FLEA-2007-0018-1: libpng mailing-list
- 20080304 CORE-2008-0124: Multiple vulnerabilities in Google's Android SDK mailing-list
- 24000 vdb-entry
- 24023 vdb-entry
- 1018078 vdb-entry
- 2007-0019 vendor-advisory
- USN-472-1 vendor-advisory
- ADV-2007-1838 vdb-entry
- ADV-2007-2385 vdb-entry
- ADV-2008-0924 vdb-entry
- libpng-trns-chunk-dos(34340) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:10094 signature vdb-entry
- Debian Security Tracker CVE-2007-2445 vendor-advisory