CVE-2009-0040

2009-02-2200:00:00

ubuntu.com

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.069 Low

EPSS

Percentile

93.8%

JSON

The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before
1.2.35, as used in pngcrush and other applications, allows
context-dependent attackers to cause a denial of service (application
crash) or possibly execute arbitrary code via a crafted PNG file that
triggers a free of an uninitialized pointer in (1) the png_read_png
function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/libpng/+bug/338027>

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchfirefox< 1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu1UNKNOWN
ubuntu7.10noarchfirefox< 2.0.0.21~tb.21+nobinonly-0ubuntu0.7.10.1UNKNOWN
ubuntu8.04noarchfirefox-3.0< 3.0.7+nobinonly-0ubuntu0.8.04.1UNKNOWN
ubuntu8.10noarchfirefox-3.0< 3.0.7+nobinonly-0ubuntu0.8.10.1UNKNOWN
ubuntu9.04noarchfirefox-3.0< 3.0.7+nobinonly-0ubuntu1UNKNOWN
ubuntu9.04noarchfirefox-3.5< 3.5+nobinonly-0ubuntu0.9.04.1UNKNOWN
ubuntu6.06noarchlibpng< 1.2.8rel-5ubuntu0.4UNKNOWN
ubuntu7.10noarchlibpng< 1.2.15~beta5-2ubuntu0.2UNKNOWN
ubuntu8.04noarchlibpng< 1.2.15~beta5-3ubuntu0.1UNKNOWN
ubuntu8.10noarchlibpng< 1.2.27-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	firefox	< 1.5.dfsg+1.5.0.15~prepatch080614k-0ubuntu1	UNKNOWN
ubuntu	7.10	noarch	firefox	< 2.0.0.21~tb.21+nobinonly-0ubuntu0.7.10.1	UNKNOWN
ubuntu	8.04	noarch	firefox-3.0	< 3.0.7+nobinonly-0ubuntu0.8.04.1	UNKNOWN
ubuntu	8.10	noarch	firefox-3.0	< 3.0.7+nobinonly-0ubuntu0.8.10.1	UNKNOWN
ubuntu	9.04	noarch	firefox-3.0	< 3.0.7+nobinonly-0ubuntu1	UNKNOWN
ubuntu	9.04	noarch	firefox-3.5	< 3.5+nobinonly-0ubuntu0.9.04.1	UNKNOWN
ubuntu	6.06	noarch	libpng	< 1.2.8rel-5ubuntu0.4	UNKNOWN
ubuntu	7.10	noarch	libpng	< 1.2.15~beta5-2ubuntu0.2	UNKNOWN
ubuntu	8.04	noarch	libpng	< 1.2.15~beta5-3ubuntu0.1	UNKNOWN
ubuntu	8.10	noarch	libpng	< 1.2.27-1ubuntu0.1	UNKNOWN