CVE-2008-3964

2008-09-1100:00:00

ubuntu.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

74.8%

JSON

Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before
1.4.0beta34, allow context-dependent attackers to cause a denial of service
(crash) or have unspecified other impact via a PNG image with crafted zTXt
chunks, related to (1) the png_push_read_zTXt function in pngread.c, and
possibly related to (2) pngtest.c.

Notes

Author	Note
jdstrand	off-by-one error in pngpread.c not introduced until 1.2.30, pngtest is affected

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchlibpng< 1.2.8rel-5ubuntu0.4UNKNOWN
ubuntu7.10noarchlibpng< 1.2.15~beta5-2ubuntu0.2UNKNOWN
ubuntu8.04noarchlibpng< 1.2.15~beta5-3ubuntu0.1UNKNOWN
ubuntu8.10noarchlibpng< 1.2.27-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	libpng	< 1.2.8rel-5ubuntu0.4	UNKNOWN
ubuntu	7.10	noarch	libpng	< 1.2.15~beta5-2ubuntu0.2	UNKNOWN
ubuntu	8.04	noarch	libpng	< 1.2.15~beta5-3ubuntu0.1	UNKNOWN
ubuntu	8.10	noarch	libpng	< 1.2.27-1ubuntu0.1	UNKNOWN