CVE-2009-0040

The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
VendorProductVersion
libpnglibpng
𝑥
< 1.0.43
libpnglibpng
1.2.0 ≤
𝑥
< 1.2.35
appleiphone_os
𝑥
< 3.0
applemac_os_x
𝑥
< 10.5.8
opensuseopensuse
10.3
opensuseopensuse
11.0
opensuseopensuse
11.1
suselinux_enterprise
9.0
suselinux_enterprise
10.0
debiandebian_linux
4.0
debiandebian_linux
5.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
jaunty
dne
intrepid
dne
hardy
ignored
gutsy
Fixed 2.0.0.21~tb.21+nobinonly-0ubuntu0.7.10.1
released
dapper
Fixed 1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu1
released
firefox-3.0
jaunty
Fixed 3.0.7+nobinonly-0ubuntu1
released
intrepid
Fixed 3.0.7+nobinonly-0ubuntu0.8.10.1
released
hardy
Fixed 3.0.7+nobinonly-0ubuntu0.8.04.1
released
gutsy
ignored
dapper
dne
firefox-3.5
jaunty
Fixed 3.5+nobinonly-0ubuntu0.9.04.1
released
intrepid
dne
hardy
dne
gutsy
dne
dapper
dne
iceape
jaunty
dne
intrepid
dne
hardy
dne
gutsy
ignored
dapper
dne
icedove
jaunty
dne
intrepid
dne
hardy
dne
gutsy
dne
dapper
dne
libpng
jaunty
Fixed 1.2.27-2ubuntu2
released
intrepid
Fixed 1.2.27-1ubuntu0.1
released
hardy
Fixed 1.2.15~beta5-3ubuntu0.1
released
gutsy
Fixed 1.2.15~beta5-2ubuntu0.2
released
dapper
Fixed 1.2.8rel-5ubuntu0.4
released
mozilla-thunderbird
jaunty
dne
intrepid
dne
hardy
dne
gutsy
dne
dapper
ignored
seamonkey
jaunty
ignored
intrepid
ignored
hardy
ignored
gutsy
dne
dapper
dne
thunderbird
jaunty
ignored
intrepid
ignored
hardy
ignored
gutsy
ignored
dapper
dne
xulrunner
jaunty
ignored
intrepid
ignored
hardy
ignored
gutsy
ignored
dapper
dne
xulrunner-1.9
jaunty
Fixed 1.9.0.7+nobinonly-0ubuntu1
released
intrepid
Fixed 1.9.0.7+nobinonly-0ubuntu0.8.10.1
released
hardy
Fixed 1.9.0.7+nobinonly-0ubuntu0.8.04.1
released
gutsy
ignored
dapper
dne
xulrunner-1.9.1
jaunty
Fixed 1.9.1+nobinonly-0ubuntu0.9.04.1
released
intrepid
dne
hardy
dne
gutsy
dne
dapper
dne
References