CVE-2022-3857: Null Pointer Dereference
Published Mar 6, 2023
·Updated
A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and denial of service in pngsetuppaethrow() function.
Other sources
Rejected reason: Maintainer contacted. This is a false-positive. The flaw does not actually exist and was erroneously tested.
— NVD
Affected Software
1 affected component
libpng LIBPNG=1.6.38
Event History
Mar 6, 2023
CVE Published
via MITRE·12:00 AM
Rejected
via MITRE·12:00 AM
Data Sourced
via NVD·11:15 PM
Description
Oct 29, 2024
Rejected
via MITRE·06:03 PM
Frequently Asked Questions
1
What is the vulnerability ID for this flaw in libpng?
The vulnerability ID is CVE-2022-3857.
2
What is the severity level of CVE-2022-3857?
The severity level of CVE-2022-3857 is medium.
3
What is affected by CVE-2022-3857?
The affected software is libpng version 1.6.38.
4
How can a crafted PNG image exploit this vulnerability?
A crafted PNG image can lead to a segmentation fault and denial of service in the png_setup_paeth_row() function.
5
Is there a fix available for CVE-2022-3857?
Yes, updating libpng to a version beyond 1.6.38 can fix the vulnerability.