CVE-2009-0040
Summary
| CVE | CVE-2009-0040 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-02-22 22:30:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| US-CERT Technical Cyber Security Alert TA09-218A -- Apple Updates for Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.us-cert.gov | Third Party Advisory, US Government Resource |
| ASA-2009-069 (RHSA-2009-0315) | af854a3a-2127-422b-91ae-364da2661108 | support.avaya.com | Broken Link |
| About the security content of iPhone OS 3.0 Software Update | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| [SECURITY] Fedora 9 Update: thunderbird-2.0.0.21-1.fc9 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Mailing List |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Broken Link |
| SUSE update for MozillaFirefox - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| sunsolve.sun.com/search/document.do | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | Broken Link |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2009:005 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Mailing List |
| VMSA-2009-0007 | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | Third Party Advisory |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | Broken Link |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| ftp.simplesystems.org/pub/png/src/libpng-1.2.34-ADVISORY.txt | af854a3a-2127-422b-91ae-364da2661108 | ftp.simplesystems.org | Broken Link, Vendor Advisory |
| About the security content of Safari 4.0 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| sunsolve.sun.com/search/document.do | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | Broken Link |
| APPLE-SA-2009-05-12 Security Update 2009-002 / Mac OS X v10.5.7 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Mailing List |
| Sun Solaris libpng Multiple Vulnerabilities - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| ASA-2009-208 (SUN 259989) | af854a3a-2127-422b-91ae-364da2661108 | support.avaya.com | Broken Link |
| [security-announce] SUSE Security Announcement: Mozilla Firefox (SUSE-SA | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Mailing List |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| Red Hat update for libpng - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009 -07 -08 -09 and -11 Multiple Remote Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| Debian -- Security Information -- DSA-1750-1 libpng | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Mailing List |
| About the security content of Security Update 2009-002 / Mac OS X v10.5.7 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| [security-announce] SUSE Security Announcement: Mozilla Firefox 2 (SUSE- | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Mailing List |
| Red Hat update for libpng - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| The Slackware Linux Project: Slackware Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | slackware.com | Mailing List |
| Gentoo Linux Documentation -- libpng: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| Red Hat update for firefox - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| [Security-announce] VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server | af854a3a-2127-422b-91ae-364da2661108 | lists.vmware.com | Broken Link |
| Avaya CMS Solaris libpng Multiple Vulnerabilities - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Slackware update for seamonkey - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Pngcrush libpng Uninitialised Pointer Arrays Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link, Vendor Advisory |
| SourceForge.net: PNG and MNG/JNG image formats: home site: | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | Broken Link |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Broken Link |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| Debian -- Security Information -- DSA-1830-1 icedove | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Mailing List |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Broken Link |
| Advisories | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Broken Link |
| Apple Mac OS X Security Update Fixes Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Libpng Library Uninitialized Pointer Arrays Memory Corruption Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| Apple Mac OS X Security Update Fixes Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Fedora update for thunderbird - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| SourceForge.net: PNG and MNG tools: Files | af854a3a-2127-422b-91ae-364da2661108 | sourceforge.net | Broken Link |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| [SECURITY] Fedora 9 Update: libpng10-1.0.43-1.fc9 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Mailing List |
| Gentoo update for libpng - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Debian update for libpng - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Broken Link |
| US-CERT Vulnerability Note VU#649212 | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | Broken Link, Third Party Advisory, US Government Resource |
| Gentoo Linux Documentation -- VMware Player, Server, Workstation: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | Third Party Advisory |
| APPLE-SA-2009-06-17-1 iPhone OS 3.0 Software Update | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Mailing List |
| rPath update for libpng - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| libpng Uninitialised Pointer Arrays Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link, Vendor Advisory |
| The Slackware Linux Project: Slackware Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | slackware.com | Mailing List |
| Slackware update for mozilla-thunderbird - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | Broken Link |
| [SECURITY] Fedora 10 Update: libpng10-1.0.43-1.fc10 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Mailing List |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Broken Link, Third Party Advisory, VDB Entry |
| APPLE-SA-2009-06-08-1 Safari 4.0 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Broken Link, Mailing List |
| Download LIBPNG: PNG reference library from SourceForge.net | af854a3a-2127-422b-91ae-364da2661108 | downloads.sourceforge.net | Product |
| Security Alerts - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Apple Safari Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| Fedora update for libpng10 - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| VMware ESX update for libpng - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| [SECURITY] Fedora 10 Update: thunderbird-2.0.0.21-1.fc10 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Mailing List |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| APPLE-SA-2009-08-05-1 Security Update 2009-003 / Mac OS X v10.5.8 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Mailing List |
| Support / Security / Advisories / / MDVSA-2009:075 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Broken Link |
| Mozilla Firefox Multiple Vulnerabilities - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Broken Link |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | Third Party Advisory, VDB Entry |
| Advisories:rPSA-2009-0046 - rPath Wiki | af854a3a-2127-422b-91ae-364da2661108 | wiki.rpath.com | Broken Link |
| US-CERT Technical Cyber Security Alert TA09-133A -- Apple Updates for Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.us-cert.gov | Third Party Advisory, US Government Resource |
| support.avaya.com/japple/css/japple | af854a3a-2127-422b-91ae-364da2661108 | support.avaya.com | Broken Link |
| Advisories | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | Broken Link |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Broken Link |
| About the security content of Security Update 2009-003 / Mac OS X v10.5.8 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.