CVE-2010-2249

Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.

Published: Jun 30, 2010
Updated: Apr 13, 2023
CVE: CVE-2010-2249
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.5
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWEs:

CWE-401

Affected Software
References

Software	From	Fixed in
libpng / libpng	1.4.0	1.4.3
libpng / libpng	-	1.2.44
apple / itunes	-	10.2
apple / safari	-	5.0.4
apple / iphone_os	2.0	4.1.x
apple / tvos	-	4.1.0
fedoraproject / fedora	13	13.x
fedoraproject / fedora	12	12.x
suse / linux_enterprise_server	10-sp3	10-sp3.x
opensuse / opensuse	11.1	11.1.x
suse / linux_enterprise_server	11-sp1	11-sp1.x
suse / linux_enterprise_server	9	9.x
opensuse / opensuse	11.2	11.2.x
suse / linux_enterprise_server	11	11.x
vmware / player	2.5	2.5.5
vmware / workstation	6.5.0	6.5.5
vmware / player	3.1	3.1.2
vmware / workstation	7.1	7.1.2
canonical / ubuntu_linux	9.04	9.04.x
canonical / ubuntu_linux	9.10	9.10.x
canonical / ubuntu_linux	10.04	10.04.x
canonical / ubuntu_linux	8.04	8.04.x
canonical / ubuntu_linux	6.06	6.06.x
debian / debian_linux	5.0	5.0.x

Vulnerability Database

CVE-2010-2249

Deep Security Visibility Without the Complexity