5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
0.028 Low
EPSS
Percentile
90.7%
The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55,
1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows
remote attackers to cause a denial of service (application crash) via a
crafted PNG image that triggers an out-of-bounds read during the copying of
error-message data. NOTE: this vulnerability exists because of a
CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some
sources.
Author | Note |
---|---|
mdeslaur | re-introduced in 1.2.23 |
jdstrand | firefox 3.6.23 has 1.2.35 and 7.0.1 has 1.4.7 |
micahg | firefox 8 will have 1.4.8 |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 10.04 | noarch | chromium-browser | < 14.0.835.202~r103287-0ubuntu0.10.04.2 | UNKNOWN |
ubuntu | 10.10 | noarch | chromium-browser | < 14.0.835.202~r103287-0ubuntu0.10.10.1 | UNKNOWN |
ubuntu | 11.04 | noarch | chromium-browser | < 14.0.835.202~r103287-0ubuntu0.11.04.1 | UNKNOWN |
ubuntu | 11.10 | noarch | chromium-browser | < 14.0.835.202~r103287-0ubuntu1 | UNKNOWN |
ubuntu | 10.04 | noarch | firefox | < 10.0+build1-0ubuntu0.10.04.2 | UNKNOWN |
ubuntu | 11.04 | noarch | firefox | < 8.0+build1-0ubuntu0.11.04.1 | UNKNOWN |
ubuntu | 11.10 | noarch | firefox | < 8.0+build1-0ubuntu0.11.10.1 | UNKNOWN |
ubuntu | 12.04 | noarch | firefox | < 8.0~b4+build1-0ubuntu2 | UNKNOWN |
ubuntu | 10.04 | noarch | libpng | < 1.2.42-1ubuntu2.2 | UNKNOWN |
ubuntu | 10.10 | noarch | libpng | < 1.2.44-1ubuntu0.1 | UNKNOWN |
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
0.028 Low
EPSS
Percentile
90.7%