CVE-2008-5907: Double Free
The pngcheckkeyword function in pngwutil.c in libpng before 1.0.42, and 1.2.x before 1.2.34, might allow context-dependent attackers to set the value of an arbitrary memory location to zero via vectors involving creation of crafted PNG files with keywords, related to an implicit cast of the '\0' character constant to a NULL pointer. NOTE: some sources incorrectly report this as a double free vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5907?
CVE-2008-5907 has a medium severity level due to potential memory manipulation vulnerabilities.
How do I fix CVE-2008-5907?
To fix CVE-2008-5907, upgrade to libpng version 1.0.42 or later, or 1.2.34 or later.
Which versions of libpng are affected by CVE-2008-5907?
CVE-2008-5907 affects libpng versions before 1.0.42 and from 1.2.0 to 1.2.33.
Can CVE-2008-5907 be exploited remotely?
Yes, CVE-2008-5907 can be exploited remotely through crafted PNG files.
What are the potential impacts of CVE-2008-5907?
The potential impacts of CVE-2008-5907 include arbitrary memory manipulation which could lead to application crashes or execution of arbitrary code.