National Cyber-Alert System

Vulnerability Summary for CVE-2004-0599

Overview

Multiple integer overflows in the (1) png_read_png in pngread.c or (2) png_handle_sPLT functions in pngrutil.c or (3) progressive display image reading capability in libpng 1.2.5 and earlier allow remote attackers to cause a denial of service (application crash) via a malformed PNG image.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA04-217A

Name: TA04-217A

Type: Advisory

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA04-217A.html

US-CERT Vulnerability Note: VU#477512

Name: VU#477512

Type: Advisory

Hyperlink:http://www.kb.cert.org/vuls/id/477512

US-CERT Vulnerability Note: VU#286464

Name: VU#286464

Type: Advisory

Hyperlink:http://www.kb.cert.org/vuls/id/286464

US-CERT Vulnerability Note: VU#160448

Name: VU#160448

Type: Advisory

Hyperlink:http://www.kb.cert.org/vuls/id/160448

External Source: FEDORA

Name: FLSA:1943

Type: Patch Information

Hyperlink:https://bugzilla.fedora.us/show_bug.cgi?id=1943

External Source: BID

Name: 10857

Type: Advisory; Patch Information

Hyperlink:http://www.securityfocus.com/bid/10857

External Source: SUSE

Name: SUSE-SA:2004:023

Type: Advisory; Patch Information

Hyperlink:http://www.novell.com/linux/security/advisories/2004_23_libpng.html

External Source: GENTOO

Name: GLSA-200408-22

Type: Advisory; Patch Information

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml

External Source: GENTOO

Name: GLSA-200408-03

Type: Advisory; Patch Information

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml

External Source: DEBIAN

Name: DSA-571

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2004/dsa-571

External Source: DEBIAN

Name: DSA-570

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2004/dsa-570

External Source: DEBIAN

Name: DSA-536

Type: Advisory; Patch Information

Hyperlink:http://www.debian.org/security/2004/dsa-536

External Source: FEDORA

Name: FLSA:2089

Type: Advisory; Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=109900315219363&w=2

External Source: SCO

Name: SCOSA-2004.16

Type: Advisory; Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=109761239318458&w=2

External Source: HP

Name: SSRT4778

Type: Advisory; Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=109181639602978&w=2

External Source: BUGTRAQ

Name: 20040804 [OpenPKG-SA-2004.035] OpenPKG Security Advisory (png)

Type: Advisory; Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=109163866717909&w=2

External Source: XF

Name: lilbpng-integer-bo(16896)

Type: Advisory

Hyperlink:http://xforce.iss.net/xforce/xfdb/16896

External Source: TRUSTIX

Name: 2004-0040

Type: Advisory

Hyperlink:http://www.trustix.net/errata/2004/0040/

External Source: BID

Name: 15495

Hyperlink:http://www.securityfocus.com/bid/15495

External Source: REDHAT

Name: RHSA-2004:429

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-429.html

External Source: REDHAT

Name: RHSA-2004:421

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-421.html

External Source: REDHAT

Name: RHSA-2004:402

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-402.html

External Source: CONFIRM

Name: http://www.mozilla.org/projects/security/known-vulnerabilities.html

Hyperlink:http://www.mozilla.org/projects/security/known-vulnerabilities.html

External Source: MISC

Name: http://scary.beasts.org/security/CESA-2004-001.txt

Type: Advisory

Hyperlink:http://scary.beasts.org/security/CESA-2004-001.txt

External Source: APPLE

Name: APPLE-SA-2004-09-09

Hyperlink:http://lists.apple.com/mhonarc/security-announce/msg00056.html

External Source: CONECTIVA

Name: CLA-2004:856

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856

External Source: SCO

Name: SCOSA-2005.49

Hyperlink:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt

External Source: MANDRIVA

Name: MDKSA-2006:213

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:213

External Source: MANDRIVA

Name: MDKSA-2006:212

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:212

External Source: MANDRAKE

Name: MDKSA-2004:079

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2004:079

External Source: SUNALERT

Name: 200663

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1

External Source: SECUNIA

Name: 22958

Hyperlink:http://secunia.com/advisories/22958

External Source: SECUNIA

Name: 22957

Hyperlink:http://secunia.com/advisories/22957

External Source: MANDRIVA

Name: MDKSA-2006:213

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:213

External Source: MANDRIVA

Name: MDKSA-2006:212

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:212

US Government Resource: oval:org.mitre.oval:def:1479

Name: oval:org.mitre.oval:def:1479

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1479