CVE-2010-0205

Published: Mar 3, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

Affected (21)

Products: Libpng: Libpng · Apple: Mac Os X · Fedoraproject: Fedora · +4 more

Show all products

Libpng: Libpng · Apple: Mac Os X · Fedoraproject: Fedora · Opensuse: Opensuse · Suse: Linux Enterprise Server · Canonical: Ubuntu Linux · Debian: Debian Linux

1 product

1 product

1 product

1 product

1 product

Linux Enterprise Server

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Libpng Libpng	From 1.0.0 to 1.0.53
Libpng Libpng	From 1.2.0 to 1.2.43
Libpng Libpng	From 1.4.0 to 1.4.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Before 10.6.5

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 11
Fedoraproject Fedora	Version 12
Fedoraproject Fedora	Version 13

Configuration D

7 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.0
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.2
Suse Linux Enterprise Server	Version 10 sp3
Suse Linux Enterprise Server	Version 11
Suse Linux Enterprise Server	Version 11 sp1
Suse Linux Enterprise Server	Version 9

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (70)

http://libpng.sourceforge.net/ADVISORY-1.4.1.html

Source: cret@cert.org

Third Party Advisory

http://libpng.sourceforge.net/decompression_bombs.html

Source: cret@cert.org

Third Party Advisory

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037237.html

Source: cret@cert.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037355.html

Source: cret@cert.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037364.html

Source: cret@cert.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037607.html

Source: cret@cert.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html

Source: cret@cert.org

Mailing List

http://lists.vmware.com/pipermail/security-announce/2010/000105.html

Source: cret@cert.org

Third Party Advisory

http://osvdb.org/62670

Source: cret@cert.org

Broken Link

http://secunia.com/advisories/38774

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/39251

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/41574

Source: cret@cert.org

Third Party Advisory

http://support.apple.com/kb/HT4435

Source: cret@cert.org

Broken Link

http://ubuntu.com/usn/usn-913-1

Source: cret@cert.org

Third Party Advisory

http://www.debian.org/security/2010/dsa-2032

Source: cret@cert.org

Third Party Advisory

http://www.kb.cert.org/vuls/id/576029

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2010:063

Source: cret@cert.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2010:064

Source: cret@cert.org

Third Party Advisory

http://www.securityfocus.com/bid/38478

Source: cret@cert.org

PatchThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1023674

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.vmware.com/security/advisories/VMSA-2010-0014.html

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0517

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0605

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0626

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0637

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0667

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0682

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0686

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/0847

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/1107

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2010/2491

Source: cret@cert.org

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/56661

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://libpng.sourceforge.net/ADVISORY-1.4.1.html