CVE-2006-3334

Description

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to "chunk error processing," possibly involving the "chunk_name".

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 1.75% Top 20%

Vendor Advisory gentoo.org Vendor Advisory mandriva.com Vendor Advisory novell.com Vendor Advisory apple.com Vendor Advisory mandriva.com Vendor Advisory gentoo.org Vendor Advisory mandriva.com Vendor Advisory mandriva.com Vendor Advisory novell.com Vendor Advisory mandriva.com

Affected: n/a n/a

References

Link	Tags
http://security.gentoo.org/glsa/glsa-200607-06.xml	vendor advisory
http://www.securityfocus.com/bid/18698	vdb entry
http://www.mandriva.com/security/advisories?name=MDKSA-2006:209	vendor advisory
http://secunia.com/advisories/22956	third party advisory
http://secunia.com/advisories/22958	third party advisory
http://www.securityfocus.com/archive/1/440594/100/0/threaded	mailing list
http://www.novell.com/linux/security/advisories/2006_28_sr.html	vendor advisory
http://www.vupen.com/english/advisories/2006/2585	vdb entry
http://www.vupen.com/english/advisories/2008/0924/references	vdb entry
http://secunia.com/advisories/23335	third party advisory
http://secunia.com/advisories/29420	third party advisory
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:210	vendor advisory
http://security.gentoo.org/glsa/glsa-200812-15.xml	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:213	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:212	vendor advisory
http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=428123
http://www.novell.com/linux/security/advisories/2006_16_sr.html	vendor advisory
http://docs.info.apple.com/article.html?artnum=307562
http://secunia.com/advisories/33137	third party advisory
https://issues.rpath.com/browse/RPL-517
http://www.mandriva.com/security/advisories?name=MDKSA-2006:211	vendor advisory
http://secunia.com/advisories/20960	third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27468	vdb entry
http://secunia.com/advisories/22957	third party advisory

Frequently Asked Questions

What is the severity of CVE-2006-3334?: CVE-2006-3334 has been scored as a high severity vulnerability.
How to fix CVE-2006-3334?: To fix CVE-2006-3334, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-3334 being actively exploited in the wild?: It is possible that CVE-2006-3334 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~2% probability that this vulnerability will be exploited by malicious actors in the next 30 days.