CVE-2004-0598

Public Exploit

Description

The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 31.35% Top 5%

Vendor Advisory trustix.net Vendor Advisory sun.com Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory fedora.us Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory apple.com Vendor Advisory marc.info Vendor Advisory mandriva.com Vendor Advisory mandriva.com Vendor Advisory com.br Vendor Advisory novell.com Vendor Advisory gentoo.org Vendor Advisory mandriva.com Vendor Advisory beasts.org Vendor Advisory securityfocus.com

Affected: n/a n/a

References

Link	Tags
http://www.trustix.net/errata/2004/0040/	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1	vendor advisory
http://www.mozilla.org/projects/security/known-vulnerabilities.html
http://www.redhat.com/support/errata/RHSA-2004-402.html	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10203	vdb entry signature
http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml	patch vendor advisory
http://secunia.com/advisories/22958	third party advisory
https://bugzilla.fedora.us/show_bug.cgi?id=1943	patch vendor advisory
http://marc.info/?l=bugtraq&m=109761239318458&w=2	vendor advisory
http://scary.beasts.org/security/CESA-2004-001.txt	exploit vendor advisory
http://www.redhat.com/support/errata/RHSA-2004-429.html	vendor advisory
http://www.debian.org/security/2004/dsa-536	patch vendor advisory
http://lists.apple.com/mhonarc/security-announce/msg00056.html	vendor advisory
http://marc.info/?l=bugtraq&m=109163866717909&w=2	mailing list
http://marc.info/?l=bugtraq&m=109181639602978&w=2	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:213	vendor advisory
http://www.us-cert.gov/cas/techalerts/TA04-217A.html	third party advisory us government resource
http://www.mandriva.com/security/advisories?name=MDKSA-2006:212	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16895	vdb entry
http://www.kb.cert.org/vuls/id/236656	third party advisory us government resource
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856	vendor advisory
http://www.securityfocus.com/bid/10857	exploit vdb entry patch vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2572	vdb entry signature
http://www.novell.com/linux/security/advisories/2004_23_libpng.html	patch vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml	patch vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:079	vendor advisory
http://secunia.com/advisories/22957	third party advisory

Frequently Asked Questions

What is the severity of CVE-2004-0598?: CVE-2004-0598 has been scored as a medium severity vulnerability.
How to fix CVE-2004-0598?: To fix CVE-2004-0598, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2004-0598 being actively exploited in the wild?: It is possible that CVE-2004-0598 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~31% probability that this vulnerability will be exploited by malicious actors in the next 30 days.