CVE-2012-4432 Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette reduction."
HighCVSS 7.5
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette reduction."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| optipng | = 0.7.0 | No fix listed |
| optipng | = 0.7.1 | No fix listed |
| optipng | = 0.7.2 | No fix listed |
| optipng | = hg | No fix listed |
References
- optipng.hg.sourceforge.net exploit
- optipng.sourceforge.net patch vendor-advisory
- 50654 third-party-advisory vendor-advisory
- sourceforge.net
- [oss-security] 20120917 CVE request: OptiPNG Palette Reduction Use-After-Free Vulnerability exploit mailing-list patch
- [oss-security] 20120917 Re: CVE request: OptiPNG Palette Reduction Use-After-Free Vulnerability exploit mailing-list patch
- 55566 vdb-entry
- optipng-palette-code-execution(78743) vdb-entry
- Debian Security Tracker CVE-2012-4432 vendor-advisory