CVE-2010-0205: Medium severity libpng LIBPNG vulnerability
The pngdecompresschunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0205?
CVE-2010-0205 has a moderate severity level due to its potential to cause denial of service through crafted PNG images.
How do I fix CVE-2010-0205?
To fix CVE-2010-0205, upgrade libpng to version 1.0.53, 1.2.43, or 1.4.1 or later.
Which versions of libpng are affected by CVE-2010-0205?
CVE-2010-0205 affects libpng versions prior to 1.0.53, 1.2.43, and 1.4.1.
Can CVE-2010-0205 be exploited remotely?
Yes, CVE-2010-0205 can be exploited remotely through crafted PNG files that trigger the vulnerability.
What types of systems are impacted by CVE-2010-0205?
CVE-2010-0205 impacts various systems including macOS, Fedora, SUSE, and Ubuntu that use vulnerable versions of libpng.