CVE-2015-2158

Published: Oct 6, 2017Modified: May 13, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.

Affected (1)

Products: Pngcrush Project: Pngcrush

Pngcrush Project

1 product

Pngcrush

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pngcrush Project Pngcrush	Up to 1.7.83

Related CWEs

CWE-189

References (8)

http://www.openwall.com/lists/oss-security/2015/03/01/1

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/72830

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1198171

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released/

Source: cve@mitre.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/03/01/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/72830

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=1198171

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.