CVE-2002-0728

Buffer overflow in the progressive reader for libpng 1.2.x before 1.2.4, and 1.0.x before 1.0.14, allows attackers to cause a denial of service (crash) via a PNG data stream that has more IDAT data than indicated by the IHDR chunk.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
ftp://swrinde.nde.swri.edu/pub/png-group/archives/png-list.200207	Vendor Advisory
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000512
http://rhn.redhat.com/errata/RHSA-2002-152.html
http://www.debian.org/security/2002/dsa-140
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-049.php

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:greg_roelofs:libpng:1.0.14:::::::*
	cpe:2.3:a:greg_roelofs:libpng:1.2.4:::::::*

History

No history.

Information

Published : 2002-08-12 04:00

Updated : 2023-12-10 10:17

NVD link : CVE-2002-0728

Mitre link : CVE-2002-0728

CVE.ORG link : CVE-2002-0728

JSON object : View

Products Affected

greg_roelofs

libpng

CWE

NVD-CWE-Other

{"id": "CVE-2002-0728", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2002-08-12T04:00:00.000", "references": [{"url": "ftp://swrinde.nde.swri.edu/pub/png-group/archives/png-list.200207", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000512", "source": "cve@mitre.org"}, {"url": "http://rhn.redhat.com/errata/RHSA-2002-152.html", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2002/dsa-140", "source": "cve@mitre.org"}, {"url": "http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-049.php", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Buffer overflow in the progressive reader for libpng 1.2.x before 1.2.4, and 1.0.x before 1.0.14, allows attackers to cause a denial of service (crash) via a PNG data stream that has more IDAT data than indicated by the IHDR chunk."}, {"lang": "es", "value": "Desbordamiento de b\u00fafer en la lectura progresiva con libpng 1.2.4 y 1.0.14 permite que atacantes remotos provoquen una denegaci\u00f3n de servicio por medio de un stream de datos PNG que tiene m\u00e1s datos IDAT de los que se indican en el chunk IHDR."}], "lastModified": "2008-09-05T20:28:47.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:greg_roelofs:libpng:1.0.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26C6F860-C157-4FBA-ABD9-7C4451B241D3"}, {"criteria": "cpe:2.3:a:greg_roelofs:libpng:1.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A243D85-1BF9-4F26-9BFE-54AA2C92C577"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}