Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2008-5907

The png_check_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory location to zero via vectors involving creation of crafted PNG files with keywords, related to an implicit cast of the '\0' character constant to a NULL pointer. NOTE: some sources incorrectly report this as a double free vulnerability.

Published

2009-01-15T17:30:00.453

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	libpng	libpng	< 1.0.42	Yes
Application	libpng	libpng	< 1.2.34	Yes
Operating System	debian	debian_linux	4.0	Yes
Operating System	debian	debian_linux	5.0	Yes

References

http://libpng.sourceforge.net/index.html Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html Third Party Advisory ([email protected])
http://openwall.com/lists/oss-security/2009/01/09/1 Mailing List, Third Party Advisory ([email protected])
http://secunia.com/advisories/34320 Third Party Advisory ([email protected])
http://secunia.com/advisories/34388 Third Party Advisory ([email protected])
http://security.gentoo.org/glsa/glsa-200903-28.xml Third Party Advisory ([email protected])
http://sourceforge.net/mailarchive/forum.php?thread_name=4B6F0239C13D0245820603C036D180BC79FBAA%40CABOTUKEXCH01.cabot.local&forum_name=png-mng-implement Third Party Advisory ([email protected])
http://www.debian.org/security/2009/dsa-1750 Third Party Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2009:051 Third Party Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/48128 Third Party Advisory, VDB Entry ([email protected])
http://libpng.sourceforge.net/index.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://openwall.com/lists/oss-security/2009/01/09/1 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34320 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/34388 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200903-28.xml Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://sourceforge.net/mailarchive/forum.php?thread_name=4B6F0239C13D0245820603C036D180BC79FBAA%40CABOTUKEXCH01.cabot.local&forum_name=png-mng-implement Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2009/dsa-1750 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2009:051 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/48128 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)