CVE-2005-2096

Description

zlib 1.2 and later versions allows remote attackers to cause a denial of service (crash) via a crafted compressed stream with an incomplete code description of a length greater than 1, which leads to a buffer overflow, as demonstrated using a crafted PNG file.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 48.84% Top 5%

Vendor Advisory sun.com Vendor Advisory debian.org Vendor Advisory apple.com Vendor Advisory freebsd.org Vendor Advisory debian.org Vendor Advisory gentoo.org Vendor Advisory mandriva.com Vendor Advisory ubuntulinux.org Vendor Advisory ubuntu.com Vendor Advisory securityfocus.com Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory apple.com Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory gentoo.org Vendor Advisory sco.com Vendor Advisory apple.com Vendor Advisory redhat.com Vendor Advisory secunia.com Vendor Advisory securitytracker.com Vendor Advisory redhat.com

Affected: n/a n/a

References

Link	Tags
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101989-1	patch vendor advisory
http://www.debian.org/security/2006/dsa-1026	vendor advisory
http://secunia.com/advisories/17236	third party advisory
http://www.securityfocus.com/archive/1/482505/100/0/threaded	mailing list
https://exchange.xforce.ibmcloud.com/vulnerabilities/24064	vdb entry
http://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html	vendor advisory
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:16.zlib.asc	vendor advisory
http://secunia.com/advisories/15949	third party advisory patch vendor advisory
http://www.debian.org/security/2005/dsa-797	patch vendor advisory
http://www.gentoo.org/security/en/glsa/glsa-200509-18.xml	patch vendor advisory
http://securitytracker.com/id?1014398	vdb entry vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:196	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1542	vdb entry signature
http://www.securityfocus.com/archive/1/464745/100/0/threaded	mailing list
http://www.ubuntulinux.org/usn/usn-151-3	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1262	vdb entry signature
http://www.securityfocus.com/archive/1/482601/100/0/threaded	mailing list
http://secunia.com/advisories/18507	third party advisory
http://secunia.com/advisories/17054	third party advisory
https://usn.ubuntu.com/148-1/	vendor advisory
http://www.securityfocus.com/bid/14162	vdb entry patch
http://www.vmware.com/support/vi3/doc/esx-9916286-patch.html
http://www.securityfocus.com/archive/1/421411/100/0/threaded	vendor advisory
http://secunia.com/advisories/31492	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:070	vendor advisory
http://www.redhat.com/support/errata/RHSA-2008-0629.html	vendor advisory
http://secunia.com/advisories/17225	third party advisory
http://www.vupen.com/english/advisories/2007/1267	vdb entry
http://www.vmware.com/support/vi3/doc/esx-3616065-patch.html
http://secunia.com/advisories/18406	third party advisory
http://www.securityfocus.com/archive/1/482950/100/0/threaded	mailing list
http://secunia.com/advisories/24788	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:112	vendor advisory
http://secunia.com/advisories/32706	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11500	vdb entry signature
http://secunia.com/advisories/17326	third party advisory
http://www.vupen.com/english/advisories/2005/0978	vdb entry
http://www.securityfocus.com/archive/1/482503/100/0/threaded	mailing list
http://www.securityfocus.com/archive/1/482949/100/0/threaded	mailing list
http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html	vendor advisory
http://secunia.com/advisories/17516	third party advisory
http://www.debian.org/security/2005/dsa-740	patch vendor advisory
http://www.vupen.com/english/advisories/2006/0144	vdb entry
http://support.apple.com/kb/HT3298
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162391	vendor advisory
http://www.redhat.com/support/errata/RHSA-2005-569.html	patch vendor advisory
http://security.gentoo.org/glsa/glsa-200507-05.xml	patch vendor advisory
http://secunia.com/advisories/19597	third party advisory
http://support.avaya.com/elmodocs2/security/ASA-2006-016.htm
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.6/SCOSA-2006.6.txt	vendor advisory
http://secunia.com/advisories/19550	third party advisory
http://secunia.com/advisories/18377	third party advisory
http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html	vendor advisory
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162680	vendor advisory
http://www.kb.cert.org/vuls/id/680620	third party advisory us government resource
http://www.securityfocus.com/archive/1/482571/100/0/threaded	mailing list

Frequently Asked Questions

What is the severity of CVE-2005-2096?: CVE-2005-2096 has been scored as a high severity vulnerability.
How to fix CVE-2005-2096?: To fix CVE-2005-2096, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-2096 being actively exploited in the wild?: It is possible that CVE-2005-2096 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~49% probability that this vulnerability will be exploited by malicious actors in the next 30 days.