Lucene search

MitreCVE-2010-1205

HistoryJun 30, 2010 - 6:30 p.m.

CVE-2010-1205

2010-06-3018:30:01

CWE-120

mitre

web.nvd.nist.gov

106

cve-2010-1205

buffer overflow

libpng

remote code execution

png image

security vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.691

Percentile

98.0%

JSON

Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.

Affected configurations

Nvd

Node

libpnglibpngRange<1.2.44

libpnglibpngRange1.4.0–1.4.3

Node

googlechromeRange<5.0.375.99

Node

appleitunesRange<10.2

applesafariRange<5.0.4

appleiphone_osRange2.0–4.1

applemac_os_xRange10.6.0–10.6.4

applemac_os_x_serverRange10.6.0–10.6.4

Node

fedoraprojectfedoraMatch12

fedoraprojectfedoraMatch13

Node

opensuseopensuseMatch11.1

opensuseopensuseMatch11.2

suselinux_enterprise_serverMatch9

suselinux_enterprise_serverMatch10sp3

suselinux_enterprise_serverMatch11-

suselinux_enterprise_serverMatch11sp1

Node

vmwareplayerRange2.5–2.5.5

vmwareplayerRange3.1–3.1.2

vmwareworkstationRange6.5.0–6.5.5

vmwareworkstationRange7.1–7.1.2

Node

canonicalubuntu_linuxMatch6.06

canonicalubuntu_linuxMatch8.04

canonicalubuntu_linuxMatch9.04

canonicalubuntu_linuxMatch9.10

canonicalubuntu_linuxMatch10.04-

Node

debiandebian_linuxMatch5.0

Node

mozillafirefoxRange<3.5.11

mozillafirefoxRange3.5.12–3.6.7

mozillaseamonkeyRange<2.0.6

mozillathunderbirdRange<3.0.6

mozillathunderbirdRange3.0.7–3.1.1

VendorProductVersionCPE
libpnglibpng*cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
googlechrome*cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
appleitunes*cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*
applesafari*cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
applemac_os_x*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
applemac_os_x_server*cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*
fedoraprojectfedora12cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*
fedoraprojectfedora13cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*
opensuseopensuse11.1cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libpng	libpng	*	cpe:2.3:a:libpng:libpng::::::::
google	chrome	*	cpe:2.3:a:google:chrome::::::::
apple	itunes	*	cpe:2.3:a:apple:itunes::::::::
apple	safari	*	cpe:2.3:a:apple:safari::::::::
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	mac_os_x	*	cpe:2.3:o:apple:mac_os_x::::::::
apple	mac_os_x_server	*	cpe:2.3:o:apple:mac_os_x_server::::::::
fedoraproject	fedora	12	cpe:2.3:o:fedoraproject:fedora:12:::::::*
fedoraproject	fedora	13	cpe:2.3:o:fedoraproject:fedora:13:::::::*
opensuse	opensuse	11.1	cpe:2.3:o:opensuse:opensuse:11.1:::::::*

Rows per page:

1-10 of 261

References

blackberry.com/btsc/KB27244

code.google.com/p/chromium/issues/detail?id=45983

googlechromereleases.blogspot.com/2010/07/stable-channel-update.html

libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=188eb6b42602bf7d7ae708a21897923b6a83fe7c#patch18

lists.apple.com/archives/security-announce/2010//Aug/msg00003.html

lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

lists.apple.com/archives/security-announce/2010//Nov/msg00003.html

lists.apple.com/archives/security-announce/2011//Mar/msg00004.html

lists.apple.com/archives/security-announce/2011/Mar/msg00000.html

lists.fedoraproject.org/pipermail/package-announce/2010-July/044283.html

lists.fedoraproject.org/pipermail/package-announce/2010-July/044397.html

lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

lists.vmware.com/pipermail/security-announce/2010/000105.html

secunia.com/advisories/40302

secunia.com/advisories/40336

secunia.com/advisories/40472

secunia.com/advisories/40547

secunia.com/advisories/41574

secunia.com/advisories/42314

secunia.com/advisories/42317

slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.613061

support.apple.com/kb/HT4312

support.apple.com/kb/HT4435

support.apple.com/kb/HT4456

support.apple.com/kb/HT4457

support.apple.com/kb/HT4554

support.apple.com/kb/HT4566

trac.webkit.org/changeset/61816

www.debian.org/security/2010/dsa-2072

www.libpng.org/pub/png/libpng.html

www.mandriva.com/security/advisories?name=MDVSA-2010:133

www.mozilla.org/security/announce/2010/mfsa2010-41.html

www.securityfocus.com/bid/41174

www.ubuntu.com/usn/USN-960-1

www.vmware.com/security/advisories/VMSA-2010-0014.html

www.vupen.com/english/advisories/2010/1612

www.vupen.com/english/advisories/2010/1637

www.vupen.com/english/advisories/2010/1755

www.vupen.com/english/advisories/2010/1837

www.vupen.com/english/advisories/2010/1846

www.vupen.com/english/advisories/2010/1877

www.vupen.com/english/advisories/2010/2491

www.vupen.com/english/advisories/2010/3045

www.vupen.com/english/advisories/2010/3046

bugs.webkit.org/show_bug.cgi?id=40798

bugzilla.mozilla.org/show_bug.cgi?id=570451

bugzilla.redhat.com/show_bug.cgi?id=608238

exchange.xforce.ibmcloud.com/vulnerabilities/59815

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11851

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.691

Percentile

98.0%

JSON

CVE-2010-1205

Affected configurations

References

Related