Unscored severity · published Nov 23, 2004
CVE-2004-0597
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the…
–
CVSS
81.9%
EPSS
No
On KEV
Description
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Exploitation
Is it being used?
Exploit prediction (EPSS)81.9% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libpng · Greg Roelofs
through 1.2.5 · source: NVD
MM
Msn Messenger · Microsoft
6.1; 6.2 · source: NVD
W9
Windows 98se · Microsoft
All versions, or not specified · source: NVD
WM
Windows ME · Microsoft
All versions, or not specified · source: NVD
WM
Windows Media Player · Microsoft
9 · source: NVD
WM
Windows Messenger · Microsoft
5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0597
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856
lists.apple.com
http://lists.apple.com/mhonarc/security-announce/msg00056.html
marc.info
http://marc.info/?l=bugtraq&m=109163866717909&w=2
marc.info
http://marc.info/?l=bugtraq&m=109181639602978&w=2
marc.info
http://marc.info/?l=bugtraq&m=109761239318458&w=2
More from Libpng
–
CVE-2011-3328
The png_handle_cHRM function in pngrutil.c in libpng 1.5.4, when color-correction support is enabled, allows remote attackers to cause a denial of service (divide-by-zero error…
–
CVE-2006-5793
The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent…
–
CVE-2006-3334
Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute…
–
CVE-2006-0481
Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler…
–
CVE-2004-0599
Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5…