PT-2010-1082 · Libpng+2 · Libpng+2

Jan Lieskovsky · Published 2010-06-30 · Updated 2023-02-13 · CVE-2010-2249

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libpng versions prior to 1.4.3 libpng versions 1.4.x prior to 1.4.3 libpng versions prior to 1.2.44

Description The issue is related to multiple vulnerabilities in the libpng package, which can be exploited remotely, leading to a denial of service and potential disruption of protected information. Specifically, a memory leak in pngrutil.c in libpng allows remote attackers to cause a denial of service via a PNG image containing malformed Physical Scale chunks.

Recommendations For libpng versions prior to 1.4.3, update to version 1.4.3 or later to resolve the issue. For libpng versions 1.4.x prior to 1.4.3, update to version 1.4.3 or later to resolve the issue. For libpng versions prior to 1.2.44, update to version 1.2.44 or later to resolve the issue.

Fix

DoS

Resource Exhaustion

Memory Leak

Weakness Enumeration

CWE-400

CWE-401

Related Identifiers

AZL-40809

AZL-43960

AZL-44709

BDU:2015-09413

CVE-2010-2249

DSA-2072-1

RHSA-2010:0534

RHSA-2010_0534

Affected Products

Red Hat

Vmware Workstation

Libpng

References · 49

• http://securityfocus.com/bid/41174 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=608644 · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2010:133 · Vendor Advisory
• http://libpng.org/pub/png/libpng.html · Vendor Advisory
• http://ubuntu.com/usn/USN-960-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2249 · Security Note
• https://osv.dev/vulnerability/AZL-43960 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html · Vendor Advisory
• http://debian.org/security/2010/dsa-2072 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-40809 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2249 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-2249 · Vendor Advisory