CVE-2010-0205
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 4.5%
The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.
Produtos afetados
n/a · n/aReferências
http://libpng.sourceforge.net/ADVISORY-1.4.1.htmlhttp://libpng.sourceforge.net/decompression_bombs.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-March/037237.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-March/037355.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-March/037364.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-March/037607.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000105.htmlhttp://osvdb.org/62670