CVE-2004-0597
- State
- Published
- Severity
- Not scored
- Published
- Aug 5, 2004
- Updated
- Aug 8, 2024
- Reserved
- Jun 23, 2004
Description
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 2004-0040vendor-advisory
- 200663vendor-advisory
- oval:org.mitre.oval:def:2274vdb-entrysignature
- http://www.mozilla.org/projects/security/known-vulnerabilities.html
- RHSA-2004:421vendor-advisory
- RHSA-2004:402vendor-advisory
- GLSA-200408-22vendor-advisory
- 22958third-party-advisory
- http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-114816-02-1
- FLSA:2089vendor-advisory
- FLSA:1943vendor-advisory
- oval:org.mitre.oval:def:594vdb-entrysignature
- TA05-039Athird-party-advisory
- libpng-pnghandle-bo(16894)vdb-entry
- SCOSA-2004.16vendor-advisory
- http://scary.beasts.org/security/CESA-2004-001.txt
- RHSA-2004:429vendor-advisory
- oval:org.mitre.oval:def:2378vdb-entrysignature
- 15495vdb-entry
- DSA-536vendor-advisory
- VU#388984third-party-advisory
- APPLE-SA-2004-09-09vendor-advisory
- VU#817368third-party-advisory
- 20040804 [OpenPKG-SA-2004.035] OpenPKG Security Advisory (png)mailing-list
- oval:org.mitre.oval:def:4492vdb-entrysignature
- SSRT4778vendor-advisory
- MS05-009vendor-advisory
- MDKSA-2006:213vendor-advisory
- TA04-217Athird-party-advisory
- http://www.adobe.com/support/downloads/detail.jsp?ftpID=2679
- oval:org.mitre.oval:def:7709vdb-entrysignature
- MDKSA-2006:212vendor-advisory
- 20050209 MSN Messenger PNG Image Buffer Overflow Download Shellcoded Exploitmailing-list
- http://www.coresecurity.com/common/showdoc.php?idx=421&idxseccion=10
- CLA-2004:856vendor-advisory
- 10857vdb-entry
- SUSE-SA:2004:023vendor-advisory
- GLSA-200408-03vendor-advisory
- oval:org.mitre.oval:def:11284vdb-entrysignature
- MDKSA-2004:079vendor-advisory
- 22957third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.