CVE-2008-1382
Fixed in a distro release EPSS 6%
libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.
Products: libpng
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 2.1 | libpng | 2:1.0.14-12 |
| Red Hat Enterprise Linux 2.1 | libpng-devel | 2:1.0.14-12 |
| Red Hat Enterprise Linux 4 | libpng | 2:1.2.7-3.el4_7.2 |
| Red Hat Enterprise Linux 4 | libpng-debuginfo | 2:1.2.7-3.el4_7.2 |
| Red Hat Enterprise Linux 4 | libpng-devel | 2:1.2.7-3.el4_7.2 |
| Red Hat Enterprise Linux 4 | libpng10 | 0:1.0.16-3.el4_7.3 |
| Red Hat Enterprise Linux 4 | libpng10-debuginfo | 0:1.0.16-3.el4_7.3 |
| Red Hat Enterprise Linux 4 | libpng10-devel | 0:1.0.16-3.el4_7.3 |
| Red Hat Enterprise Linux 5 | libpng | 2:1.2.10-7.1.el5_3.2 |
| Red Hat Enterprise Linux 5 | libpng-debuginfo | 2:1.2.10-7.1.el5_3.2 |
| Red Hat Enterprise Linux 5 | libpng-devel | 2:1.2.10-7.1.el5_3.2 |