CVE-2007-2445

Description

The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 47.51% Top 5%

Vendor Advisory openpkg.com Vendor Advisory slackware.com Vendor Advisory debian.org Vendor Advisory sun.com Vendor Advisory sun.com Vendor Advisory gentoo.org Vendor Advisory apple.com Vendor Advisory gentoo.org Vendor Advisory debian.org Vendor Advisory trustix.org Vendor Advisory novell.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory mirrorservice.org

Affected: n/a n/a

References

Link	Tags
http://openpkg.com/go/OpenPKG-SA-2007.013	vendor advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-254.htm
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.492650	vendor advisory
http://secunia.com/advisories/25571	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10094	signature vdb entry
http://www.kb.cert.org/vuls/id/684664	third party advisory us government resource
http://www.debian.org/security/2008/dsa-1613	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102987-1	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200871-1	vendor advisory
http://secunia.com/advisories/34388	third party advisory
http://osvdb.org/36196	vdb entry
http://www.gentoo.org/security/en/glsa/glsa-200705-24.xml	vendor advisory
http://secunia.com/advisories/25273	third party advisory vendor advisory
http://www.coresecurity.com/?action=item&id=2148
http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt	vendor advisory
http://www.securityfocus.com/bid/24023	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34340	vdb entry
http://www.vupen.com/english/advisories/2008/0924/references	vdb entry
http://irrlicht.sourceforge.net/changes.txt
http://secunia.com/advisories/25867	third party advisory
http://sourceforge.net/project/shownotes.php?release_id=508653&group_id=5624	patch
http://secunia.com/advisories/31168	third party advisory
https://issues.rpath.com/browse/RPL-1381
http://secunia.com/advisories/25329	third party advisory vendor advisory
http://secunia.com/advisories/25461	third party advisory
http://www.vupen.com/english/advisories/2007/1838	vdb entry
http://secunia.com/advisories/29420	third party advisory
http://www.vupen.com/english/advisories/2007/2385	vdb entry
http://sourceforge.net/project/shownotes.php?release_id=508656&group_id=5624	patch
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html	vendor advisory
http://secunia.com/advisories/25353	third party advisory
http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html
http://www.securityfocus.com/archive/1/468910/100/0/threaded	mailing list
http://secunia.com/advisories/30161	third party advisory
http://www.gentoo.org/security/en/glsa/glsa-200805-07.xml	vendor advisory
http://secunia.com/advisories/25554	third party advisory
http://secunia.com/advisories/25268	third party advisory vendor advisory
http://www.debian.org/security/2009/dsa-1750	vendor advisory
http://www.securitytracker.com/id?1018078	vdb entry
http://www.trustix.org/errata/2007/0019/	vendor advisory
http://www.novell.com/linux/security/advisories/2007_13_sr.html	vendor advisory
http://www.ubuntu.com/usn/usn-472-1	vendor advisory
http://secunia.com/advisories/27056	third party advisory
http://www.redhat.com/support/errata/RHSA-2007-0356.html	vendor advisory
http://secunia.com/advisories/25292	third party advisory vendor advisory
http://docs.info.apple.com/article.html?artnum=307562
http://secunia.com/advisories/25787	third party advisory
http://secunia.com/advisories/25742	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:116	vendor advisory
http://www.securityfocus.com/bid/24000	vdb entry
http://www.securityfocus.com/archive/1/489135/100/0/threaded	mailing list

Frequently Asked Questions

What is the severity of CVE-2007-2445?: CVE-2007-2445 has been scored as a medium severity vulnerability.
How to fix CVE-2007-2445?: To fix CVE-2007-2445, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-2445 being actively exploited in the wild?: It is possible that CVE-2007-2445 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~48% probability that this vulnerability will be exploited by malicious actors in the next 30 days.