CVE-2008-5907

2009-01-1517:30:00

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.2

Confidence

High

EPSS

0.007

Percentile

80.6%

JSON

The png_check_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory location to zero via vectors involving creation of crafted PNG files with keywords, related to an implicit cast of the ‘\0’ character constant to a NULL pointer. NOTE: some sources incorrectly report this as a double free vulnerability.

Affected configurations

Nvd

Node

libpnglibpngRange<1.0.42

libpnglibpngRange1.2.0–1.2.34

Node

debiandebian_linuxMatch4.0

debiandebian_linuxMatch5.0

VendorProductVersionCPE
libpnglibpng*cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
debiandebian_linux4.0cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
debiandebian_linux5.0cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libpng	libpng	*	cpe:2.3:a:libpng:libpng::::::::
debian	debian_linux	4.0	cpe:2.3:o:debian:debian_linux:4.0:::::::*
debian	debian_linux	5.0	cpe:2.3:o:debian:debian_linux:5.0:::::::*