CVEvulnerability
CVE-2008-5907
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-01-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Description
The png_check_keyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory location to zero via vectors involving creation of crafted PNG files with keywords, related to an implicit cast of the '\0' character constant to a NULL pointer. NOTE: some sources incorrectly report this as a double free vulnerability.
Affected configurations
• libpng libpng (< 1.0.42)
• libpng libpng (>= 1.2.0 < 1.2.34)
• debian debian linux 4.0
• debian debian linux 5.0
References
- http://libpng.sourceforge.net/index.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html Third Party Advisory
- http://openwall.com/lists/oss-security/2009/01/09/1 Mailing List, Third Party Advisory
- http://secunia.com/advisories/34320 Third Party Advisory
- http://secunia.com/advisories/34388 Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200903-28.xml Third Party Advisory
- http://sourceforge.net/mailarchive/forum.php?thread_name=4B6F0239C13D0245820603C036D180BC79FBAA%40CABOTUKEXCH01.cabot.local&forum_name=png-mng-implement Third Party Advisory
- http://www.debian.org/security/2009/dsa-1750 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:051 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48128 Third Party Advisory, VDB Entry
- http://libpng.sourceforge.net/index.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html Third Party Advisory
- http://openwall.com/lists/oss-security/2009/01/09/1 Mailing List, Third Party Advisory
- http://secunia.com/advisories/34320 Third Party Advisory
- http://secunia.com/advisories/34388 Third Party Advisory
- http://security.gentoo.org/glsa/glsa-200903-28.xml Third Party Advisory
- http://sourceforge.net/mailarchive/forum.php?thread_name=4B6F0239C13D0245820603C036D180BC79FBAA%40CABOTUKEXCH01.cabot.local&forum_name=png-mng-implement Third Party Advisory
- http://www.debian.org/security/2009/dsa-1750 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:051 Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48128 Third Party Advisory, VDB Entry