Unscored severity · published Oct 1, 2012
CVE-2012-4432
Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette…
–
CVSS
5.2%
EPSS
No
On KEV
Description
Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette reduction."
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Optipng · Optipng
0.7.0; 0.7.1; 0.7.2; hg · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-4432
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-4432
Exploit
http://optipng.hg.sourceforge.net/hgweb/optipng/optipng/rev/f1d5d44670a2
Patch
http://optipng.sourceforge.net/
Vendor Advisory
http://secunia.com/advisories/50654
sourceforge.net
http://sourceforge.net/news/?group_id=151404
Exploit
http://www.openwall.com/lists/oss-security/2012/09/17/5
Exploit
http://www.openwall.com/lists/oss-security/2012/09/18/2
More from Optipng
6.5
CVE-2016-2191
The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of…
–
CVE-2008-5101
Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow."