CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
AI Score
Confidence
High
EPSS
Percentile
70.0%
Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length. NOTE: this is due to an incomplete fix for CVE-2006-7244.
Vendor | Product | Version | CPE |
---|---|---|---|
libpng | libpng | * | cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* |
libpng | libpng | 1.2.39 | cpe:2.3:a:libpng:libpng:1.2.39:-:*:*:*:*:*:* |
libpng | libpng | 1.2.39 | cpe:2.3:a:libpng:libpng:1.2.39:beta1:*:*:*:*:*:* |
libpng | libpng | 1.2.39 | cpe:2.3:a:libpng:libpng:1.2.39:beta2:*:*:*:*:*:* |
libpng | libpng | 1.2.39 | cpe:2.3:a:libpng:libpng:1.2.39:beta3:*:*:*:*:*:* |
libpng | libpng | 1.2.39 | cpe:2.3:a:libpng:libpng:1.2.39:beta4:*:*:*:*:*:* |