CVE-2010-2249: Medium severity libp2p vulnerability
A memory leak was found in the way libpng processed malformed Portable Network Graphics (PNG) images with Physical Scale (sCAL) extension. A remote attacker could create a specially-crafted PNG image and trick the local user into opening it in an application, using the libpng library, leading to denial of service (relevant libpng-based application crash).
References: [1] http://www.libpng.org/pub/png/libpng.html
CVE Request: [2] http://www.openwall.com/lists/oss-security/2010/06/28/2
Other sources
Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2249?
CVE-2010-2249 has a moderate severity level due to its potential to cause denial of service.
How do I fix CVE-2010-2249?
To fix CVE-2010-2249, upgrade libpng to version 1.2.44 or later, or 1.4.3 or later.
What versions of libpng are affected by CVE-2010-2249?
Versions of libpng before 1.2.44 and 1.4.x before 1.4.3 are affected by CVE-2010-2249.
Can CVE-2010-2249 be exploited remotely?
Yes, CVE-2010-2249 can be exploited remotely through malformed PNG images.
What kind of problem does CVE-2010-2249 cause?
CVE-2010-2249 causes a memory leak, leading to memory consumption and potential application crashes.