CVE-2008-5101 Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow."
HighCVSS 9.3
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| optipng | = 0.6 | No fix listed |
| optipng | = 0.6.1 | No fix listed |
| debian/optipng(Debian:12) | < 0.6.1.1-1 | 0.6.1.1-1 |
| debian/optipng(Debian:13) | < 0.6.1.1-1 | 0.6.1.1-1 |
| debian/optipng(Debian:14) | < 0.6.1.1-1 | 0.6.1.1-1 |
References
- bugs.debian.org
- SUSE-SR:2009:006 vendor-advisory
- [oss-security] 20081112 CVE Request -- OptiPNG mailing-list
- optipng.sourceforge.net patch
- prdownloads.sourceforge.net exploit
- 32651 third-party-advisory vendor-advisory
- 34259 third-party-advisory
- GLSA-200812-01 vendor-advisory
- sourceforge.net patch
- 32248 vdb-entry
- ADV-2008-3108 vdb-entry
- optipng-bmpreader-bo(46519) vdb-entry
- Debian Security Tracker CVE-2008-5101 vendor-advisory
- bugs.debian.org issue-tracking