Lucene search

RedhatCVE-2010-2249

HistoryJun 30, 2010 - 6:30 p.m.

CVE-2010-2249

2010-06-3018:30:01

CWE-401

redhat

web.nvd.nist.gov

cve-2010-2249

memory leak

libpng

denial of service

dos

scal chunk

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.02

Percentile

88.8%

JSON

Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.

Affected configurations

Nvd

Node

libpnglibpngRange<1.2.44

libpnglibpngRange1.4.0–1.4.3

Node

appleitunesRange<10.2

applesafariRange<5.0.4

appleiphone_osRange2.0–4.1

appletvosRange<4.1.0

Node

fedoraprojectfedoraMatch12

fedoraprojectfedoraMatch13

Node

opensuseopensuseMatch11.1

opensuseopensuseMatch11.2

suselinux_enterprise_serverMatch9

suselinux_enterprise_serverMatch10sp3

suselinux_enterprise_serverMatch11-

suselinux_enterprise_serverMatch11sp1

Node

vmwareplayerRange2.5–2.5.5

vmwareplayerRange3.1–3.1.2

vmwareworkstationRange6.5.0–6.5.5

vmwareworkstationRange7.1–7.1.2

Node

canonicalubuntu_linuxMatch6.06

canonicalubuntu_linuxMatch8.04

canonicalubuntu_linuxMatch9.04

canonicalubuntu_linuxMatch9.10

canonicalubuntu_linuxMatch10.04-

Node

debiandebian_linuxMatch5.0

VendorProductVersionCPE
libpnglibpng*cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
appleitunes*cpe:2.3:a:apple:itunes:*:*:*:*:*:*:*:*
applesafari*cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
appleiphone_os*cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
appletvos*cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
fedoraprojectfedora12cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*
fedoraprojectfedora13cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*
opensuseopensuse11.1cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
opensuseopensuse11.2cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*
suselinux_enterprise_server9cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libpng	libpng	*	cpe:2.3:a:libpng:libpng::::::::
apple	itunes	*	cpe:2.3:a:apple:itunes::::::::
apple	safari	*	cpe:2.3:a:apple:safari::::::::
apple	iphone_os	*	cpe:2.3:o:apple:iphone_os::::::::
apple	tvos	*	cpe:2.3:o:apple:tvos::::::::
fedoraproject	fedora	12	cpe:2.3:o:fedoraproject:fedora:12:::::::*
fedoraproject	fedora	13	cpe:2.3:o:fedoraproject:fedora:13:::::::*
opensuse	opensuse	11.1	cpe:2.3:o:opensuse:opensuse:11.1:::::::*
opensuse	opensuse	11.2	cpe:2.3:o:opensuse:opensuse:11.2:::::::*
suse	linux_enterprise_server	9	cpe:2.3:o:suse:linux_enterprise_server:9:::::::*

Rows per page:

1-10 of 211

References

libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=90cfcecc09febb8d6c8c1d37ea7bb7cf0f4b00f3#patch20

lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

lists.apple.com/archives/security-announce/2010//Nov/msg00003.html

lists.apple.com/archives/security-announce/2011//Mar/msg00004.html

lists.apple.com/archives/security-announce/2011/Mar/msg00000.html

lists.fedoraproject.org/pipermail/package-announce/2010-July/044283.html

lists.fedoraproject.org/pipermail/package-announce/2010-July/044397.html

lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

lists.vmware.com/pipermail/security-announce/2010/000105.html

secunia.com/advisories/40302

secunia.com/advisories/40336

secunia.com/advisories/40472

secunia.com/advisories/40547

secunia.com/advisories/41574

secunia.com/advisories/42314

secunia.com/advisories/42317

slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.613061

support.apple.com/kb/HT4435

support.apple.com/kb/HT4456

support.apple.com/kb/HT4457

support.apple.com/kb/HT4554

support.apple.com/kb/HT4566

www.debian.org/security/2010/dsa-2072

www.libpng.org/pub/png/libpng.html

www.mandriva.com/security/advisories?name=MDVSA-2010:133

www.securityfocus.com/bid/41174

www.securitytracker.com/id?1024723

www.ubuntu.com/usn/USN-960-1

www.vmware.com/security/advisories/VMSA-2010-0014.html

www.vupen.com/english/advisories/2010/1612

www.vupen.com/english/advisories/2010/1637

www.vupen.com/english/advisories/2010/1755

www.vupen.com/english/advisories/2010/1837

www.vupen.com/english/advisories/2010/1846

www.vupen.com/english/advisories/2010/1877

www.vupen.com/english/advisories/2010/2491

www.vupen.com/english/advisories/2010/3045

www.vupen.com/english/advisories/2010/3046

bugzilla.redhat.com/show_bug.cgi?id=608644

exchange.xforce.ibmcloud.com/vulnerabilities/59816

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

7.4

Confidence

High

EPSS

0.02

Percentile

88.8%

JSON

Related for CVE-2010-2249