CVEvulnerability

CVE-2010-2249

6.5 MEDIUM Published 2010-06-30 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-06-30
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-401

Description

Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.

Affected configurations

• libpng libpng (< 1.2.44) • libpng libpng (>= 1.4.0 < 1.4.3) • apple itunes (< 10.2) • apple safari (< 5.0.4) • apple iphone os (>= 2.0 <= 4.1) • apple tvos (< 4.1.0) • fedoraproject fedora 12 • fedoraproject fedora 13 • opensuse opensuse 11.1 • opensuse opensuse 11.2 • suse linux enterprise server 9 • suse linux enterprise server 10 • suse linux enterprise server 11 • vmware player (>= 2.5 < 2.5.5) • vmware player (>= 3.1 < 3.1.2) • vmware workstation (>= 6.5.0 < 6.5.5) • vmware workstation (>= 7.1 < 7.1.2) • canonical ubuntu linux 6.06 • canonical ubuntu linux 8.04 • canonical ubuntu linux 9.04 • canonical ubuntu linux 9.10 • canonical ubuntu linux 10.04 • debian debian linux 5.0

Related

Weakness · CWE (1)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References