CVE-2013-7354

State: Published
Severity: 6.5 Medium
Published: May 6, 2014
Updated: Jun 9, 2025
Reserved: Apr 10, 2014

Description

Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-190 Integer Overflow or Wraparound
CWE-122 Heap-based Buffer Overflow

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://sourceforge.net/p/libpng/bugs/199/
openSUSE-SU-2014:0604vendor-advisory
67344vdb-entry
[oss-security] 20140410 CVE-2013-7353 CVE-2013-7354 libpng integer overflowsmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.