CVE-2010-1205
published 2010-06-30CVE-2010-1205: Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
43.38%
98.6th percentile
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | iphone_os | 2.0 – 4.1 | — |
| apple | itunes | < 10.2 | 10.2 |
| apple | mac_os_x | >= 10.6.0 < 10.6.4 | 10.6.4 |
| apple | mac_os_x_server | >= 10.6.0 < 10.6.4 | 10.6.4 |
| apple | safari | < 5.0.4 | 5.0.4 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | tuxonice-userui | < tuxonice-userui 1.0-1 (bookworm) | tuxonice-userui 1.0-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| chrome | < 5.0.375.99 | 5.0.375.99 | |
| libpng | libpng | < 1.2.44 | 1.2.44 |
| libpng | libpng | >= 1.4.0 < 1.4.3 | 1.4.3 |
| mozilla | firefox | < 3.5.11 | 3.5.11 |
| mozilla | firefox | >= 3.5.12 < 3.6.7 | 3.6.7 |
| mozilla | seamonkey | < 2.0.6 | 2.0.6 |
| mozilla | thunderbird | < 3.0.6 | 3.0.6 |
| mozilla | thunderbird | >= 3.0.7 < 3.1.1 | 3.1.1 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x89\x50\x4e\x47\x0d\x0a\x1a\x0a
- →Exploit triggers the overflow by crafting a PNG where the IHDR header reports HEIGHT-1 rows but the IDAT data contains HEIGHT rows, causing libpng's progressive reader (pngpread.c) to write one extra row beyond the allocated buffer. ↗
- →Crash/overflow is reliably triggered with image widths around 512 or larger (PoC uses WIDTH=700); monitor progressive PNG parsing of wide, low-height images. ↗
- →The malicious PNG uses color type 0x06 (RGBA, 8-bit depth) in the IHDR attributes block; the IDAT payload fills the oversized buffer with 0x41 bytes ('A'), a classic heap/stack spray pattern. ↗
- →The IDAT zlib block uses a stored (no-compression) deflate block (CMF=0x08, FLG=0x1d, BTYPE=01 uncompressed); detection of uncompressed deflate inside PNG IDAT with mismatched row count is a strong indicator. ↗
- ·The vulnerability is in the progressive (streaming) PNG reader (pngpread.c) only; non-progressive (standard) PNG decoding is not affected. ↗
- ·Red Hat Enterprise Linux 6 ships a libpng version that is not affected; verify the exact distribution package version before treating RHEL6 hosts as vulnerable. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_ubuntu10.0CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware Workstation, Player, and ACE address several security issues.
vendor_vmware·2010-09-23·CVSS 2.1
CVE-2010-0205 [LOW] VMware Workstation, Player, and ACE address several security issues.
VMSA-2010-0014: VMware Workstation, Player, and ACE address several security issues.
a. VMware Workstation and Player installer security issue The Workstation 7.x and Player 3.x installers will load an index.htm file located in the current working directory on which Workstation 7.x or Player 3.x is being installed. This may allow an attacker to display a malicious file if they manage to get their file onto the system prior to installation. The issue can only be exploited at the time that Workstation 7.x or Player 3.x is being installed. Installed versions of Workstation and Player are not affected. The security issue is no longer present in the installer of the new versions of Workstation 7.x and Player 3.x (see table below for the version numbers). The Common Vulnerabilities and Exposure
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2010-07-26·CVSS 4.3
CVE-2010-0654 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Several flaws were discovered in the browser engine of Thunderbird. If a
user were tricked into viewing malicious content, a remote attacker could
use this to crash Thunderbird or possibly run arbitrary code as the user
invoking the program. (CVE-2010-1211, CVE-2010-1212)
An integer overflow was discovered in how Thunderbird processed CSS values.
An attacker could exploit this to crash Thunderbird or possibly run
arbitrary code as the user invoking the program. (CVE-2010-2752)
An integer overflow was discovered in how Thunderbird interpreted the XUL
element. If a user were tricked into viewing malicious content, a remote
attacker could use this to crash Thunderbird or possibly run arbitrary code
as the user invoking the program. (CVE-2010-2753)
Aki He
Ubuntu
Firefox and Xulrunner vulnerability
vendor_ubuntu·2010-07-26·CVSS 8.8
CVE-2010-2755 [HIGH] Firefox and Xulrunner vulnerability
Title: Firefox and Xulrunner vulnerability
Summary: Firefox could be made to run programs as your login if it opened a
specially crafted file or website.
USN-957-1 fixed vulnerabilities in Firefox and Xulrunner. Daniel Holbert
discovered that the fix for CVE-2010-1214 introduced a regression which did
not properly initialize a plugin pointer. If a user were tricked into
viewing a malicious site, a remote attacker could use this to crash the
browser or run arbitrary code as the user invoking the program.
(CVE-2010-2755)
This update fixes the problem.
Original advisory details:
Several flaws were discovered in the browser engine of Firefox. If a user
were tricked into viewing a malicious site, a remote attacker could use
this to crash the browser or possibly run arbitrary code as the us
Ubuntu
Firefox and Xulrunner vulnerabilities
vendor_ubuntu·2010-07-23·CVSS 9.8
CVE-2008-5913 [CRITICAL] Firefox and Xulrunner vulnerabilities
Title: Firefox and Xulrunner vulnerabilities
Summary: Firefox could be made to run programs as your login if it opened a
specially crafted file or website.
USN-930-1 fixed vulnerabilities in Firefox and Xulrunner. This update
provides the corresponding updates for Ubuntu 9.04 and 9.10, along with
additional updates affecting Firefox 3.6.6.
Several flaws were discovered in the browser engine of Firefox. If a user
were tricked into viewing a malicious site, a remote attacker could use
this to crash the browser or possibly run arbitrary code as the user
invoking the program. (CVE-2010-1208, CVE-2010-1209, CVE-2010-1211,
CVE-2010-1212)
An integer overflow was discovered in how Firefox processed plugin
parameters. An attacker could exploit this to crash the browser or possibly
run arbitrary
Ubuntu
ant, apturl, Epiphany, gluezilla, gnome-python-extras, liferea, mozvoikko, OpenJDK, packagekit, ubufox, webfav, yelp update
vendor_ubuntu·2010-07-23·CVSS 10.0
[CRITICAL] ant, apturl, Epiphany, gluezilla, gnome-python-extras, liferea, mozvoikko, OpenJDK, packagekit, ubufox, webfav, yelp update
Title: ant, apturl, Epiphany, gluezilla, gnome-python-extras, liferea, mozvoikko, OpenJDK, packagekit, ubufox, webfav, yelp update
Summary: This update is for use with the new Xulrunner provided in USN-930-4.
USN-930-4 fixed vulnerabilities in Firefox and Xulrunner on Ubuntu 9.04 and
9.10. This update provides updated packages for use with Firefox 3.6 and
Xulrunner 1.9.2.
Original advisory details:
If was discovered that Firefox could be made to access freed memory. If a
user were tricked into viewing a malicious site, a remote attacker could
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. This issue only affected
Ubuntu 8.04 LTS. (CVE-2010-1121)
Several flaws were discovered in the browser engine of Firefox. If a
user
Ubuntu
Firefox and Xulrunner vulnerabilities
vendor_ubuntu·2010-07-23·CVSS 9.8
CVE-2010-1208 [CRITICAL] Firefox and Xulrunner vulnerabilities
Title: Firefox and Xulrunner vulnerabilities
Summary: Firefox could be made to run programs as your login if it opened a
specially crafted file or website.
Several flaws were discovered in the browser engine of Firefox. If a user
were tricked into viewing a malicious site, a remote attacker could use
this to crash the browser or possibly run arbitrary code as the user
invoking the program. (CVE-2010-1208, CVE-2010-1209, CVE-2010-1211,
CVE-2010-1212)
An integer overflow was discovered in how Firefox processed plugin
parameters. An attacker could exploit this to crash the browser or possibly
run arbitrary code as the user invoking the program. (CVE-2010-1214)
A flaw was discovered in the Firefox JavaScript engine. If a user were
tricked into viewing a malicious site, a remote attacker co
Ubuntu
libpng vulnerabilities
vendor_ubuntu·2010-07-08·CVSS 9.8
CVE-2010-2249 [CRITICAL] libpng vulnerabilities
Title: libpng vulnerabilities
It was discovered that libpng did not properly handle certain malformed PNG
images. If a user or automated system were tricked into opening a crafted
PNG file, an attacker could cause a denial of service or possibly execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2010-1205)
It was discovered that libpng did not properly handle certain malformed PNG
images. If a user or automated system were tricked into processing a
crafted PNG image, an attacker could possibly use this flaw to consume all
available resources, resulting in a denial of service. (CVE-2010-2249)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
libpng: out-of-bounds memory write
vendor_redhat·2010-06-25·CVSS 9.8
CVE-2010-1205 [CRITICAL] libpng: out-of-bounds memory write
libpng: out-of-bounds memory write
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.
Package: libpng (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2010-1205: tuxonice-userui - Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as...
vendor_debian·2010·CVSS 9.8
CVE-2010-1205 [CRITICAL] CVE-2010-1205: tuxonice-userui - Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as...
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.
Scope: local
bookworm: resolved (fixed in 1.0-1)
bullseye: resolved (fixed in 1.0-1)
GHSA
GHSA-qq2m-25fj-pxvm: Buffer overflow in pngpread
ghsa_unreviewed·2022-05-02
CVE-2010-1205 [CRITICAL] CWE-120 GHSA-qq2m-25fj-pxvm: Buffer overflow in pngpread
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.
OSV
CVE-2010-1205: Buffer overflow in pngpread
osv·2010-06-30·CVSS 9.8
CVE-2010-1205 [CRITICAL] CVE-2010-1205: Buffer overflow in pngpread
Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row.
No detection rules found.
Bugzilla
CVE-2010-1205 CVE-2010-2249 mingw32-libpng various flaws [fedora-all]
bugzilla·2010-06-29·CVSS 9.8
CVE-2010-1205 [CRITICAL] CVE-2010-1205 CVE-2010-2249 mingw32-libpng various flaws [fedora-all]
CVE-2010-1205 CVE-2010-2249 mingw32-libpng various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
Forr more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=608644
Please note: this issue affects multiple sup
Bugzilla
CVE-2010-1205 CVE-2010-2249 libpng various flaws [fedora-all]
bugzilla·2010-06-29·CVSS 9.8
CVE-2010-1205 [CRITICAL] CVE-2010-1205 CVE-2010-2249 libpng various flaws [fedora-all]
CVE-2010-1205 CVE-2010-2249 libpng various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
Forr more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=608644
Please note: this issue affects multiple supported v
Bugzilla
CVE-2010-1205 libpng: out-of-bounds memory write
bugzilla·2010-06-26·CVSS 9.8
CVE-2010-1205 [CRITICAL] CVE-2010-1205 libpng: out-of-bounds memory write
CVE-2010-1205 libpng: out-of-bounds memory write
Description of problem:
http://www.libpng.org/pub/png/libpng.html
Several versions of libpng through 1.4.2 (and through 1.2.43 in the older series) contain a bug whereby progressive applications such as web browsers (or the rpng2 demo app included in libpng) could receive an extra row of image data beyond the height reported in the header, potentially leading to an out-of-bounds write to memory (depending on how the application is written) and the possibility of execution of an attacker's code with the privileges of the libpng user (including remote compromise in the case of a libpng-based browser visiting a hostile web site). This vulnerability has been assigned ID CVE-2010-1205 (via Mozilla).
An additional memory-leak bug, involving im
http://blackberry.com/btsc/KB27244http://code.google.com/p/chromium/issues/detail?id=45983http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.htmlhttp://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=188eb6b42602bf7d7ae708a21897923b6a83fe7c#patch18http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00003.htmlhttp://lists.apple.com/archives/security-announce/2011//Mar/msg00004.htmlhttp://lists.apple.com/archives/security-announce/2011/Mar/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-July/044283.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-July/044397.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000105.htmlhttp://secunia.com/advisories/40302http://secunia.com/advisories/40336http://secunia.com/advisories/40472http://secunia.com/advisories/40547http://secunia.com/advisories/41574http://secunia.com/advisories/42314http://secunia.com/advisories/42317http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.613061http://support.apple.com/kb/HT4312http://support.apple.com/kb/HT4435http://support.apple.com/kb/HT4456http://support.apple.com/kb/HT4457http://support.apple.com/kb/HT4554http://support.apple.com/kb/HT4566http://trac.webkit.org/changeset/61816http://www.debian.org/security/2010/dsa-2072http://www.libpng.org/pub/png/libpng.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2010:133http://www.mozilla.org/security/announce/2010/mfsa2010-41.htmlhttp://www.securityfocus.com/bid/41174http://www.ubuntu.com/usn/USN-960-1http://www.vmware.com/security/advisories/VMSA-2010-0014.htmlhttp://www.vupen.com/english/advisories/2010/1612http://www.vupen.com/english/advisories/2010/1637http://www.vupen.com/english/advisories/2010/1755http://www.vupen.com/english/advisories/2010/1837http://www.vupen.com/english/advisories/2010/1846http://www.vupen.com/english/advisories/2010/1877http://www.vupen.com/english/advisories/2010/2491http://www.vupen.com/english/advisories/2010/3045http://www.vupen.com/english/advisories/2010/3046https://bugs.webkit.org/show_bug.cgi?id=40798https://bugzilla.mozilla.org/show_bug.cgi?id=570451https://bugzilla.redhat.com/show_bug.cgi?id=608238https://exchange.xforce.ibmcloud.com/vulnerabilities/59815https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11851http://blackberry.com/btsc/KB27244http://code.google.com/p/chromium/issues/detail?id=45983http://googlechromereleases.blogspot.com/2010/07/stable-channel-update.htmlhttp://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=188eb6b42602bf7d7ae708a21897923b6a83fe7c#patch18http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00003.htmlhttp://lists.apple.com/archives/security-announce/2011//Mar/msg00004.htmlhttp://lists.apple.com/archives/security-announce/2011/Mar/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-July/044283.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-July/044397.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000105.htmlhttp://secunia.com/advisories/40302http://secunia.com/advisories/40336http://secunia.com/advisories/40472http://secunia.com/advisories/40547http://secunia.com/advisories/41574http://secunia.com/advisories/42314http://secunia.com/advisories/42317http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.613061http://support.apple.com/kb/HT4312http://support.apple.com/kb/HT4435http://support.apple.com/kb/HT4456http://support.apple.com/kb/HT4457http://support.apple.com/kb/HT4554http://support.apple.com/kb/HT4566http://trac.webkit.org/changeset/61816http://www.debian.org/security/2010/dsa-2072http://www.libpng.org/pub/png/libpng.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2010:133http://www.mozilla.org/security/announce/2010/mfsa2010-41.htmlhttp://www.securityfocus.com/bid/41174http://www.ubuntu.com/usn/USN-960-1http://www.vmware.com/security/advisories/VMSA-2010-0014.htmlhttp://www.vupen.com/english/advisories/2010/1612http://www.vupen.com/english/advisories/2010/1637http://www.vupen.com/english/advisories/2010/1755http://www.vupen.com/english/advisories/2010/1837http://www.vupen.com/english/advisories/2010/1846http://www.vupen.com/english/advisories/2010/1877http://www.vupen.com/english/advisories/2010/2491http://www.vupen.com/english/advisories/2010/3045http://www.vupen.com/english/advisories/2010/3046https://bugs.webkit.org/show_bug.cgi?id=40798https://bugzilla.mozilla.org/show_bug.cgi?id=570451https://bugzilla.redhat.com/show_bug.cgi?id=608238https://exchange.xforce.ibmcloud.com/vulnerabilities/59815https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11851
2010-06-30
Published