CVE-2007-2445: png_reference_library libpng

Modified

AliasesDEBIAN-CVE-2007-2445

Published 16-05-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-2445 is a medium (CVSS 5.0) vulnerability in png_reference_library libpng. EPSS estimates a 5.21% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

5.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

DSA-1613-1 RHSA-2007:0356

Timeline

16-05-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

5.21%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

libgd2< 2.0.35.dfsg-1

Png_reference_library1 product

libpng≤ 1.0.15 | ≤ 1.2.16

2 vendors · 2 products

References

52 links

openpkg.com/go/OpenPKG-SA-2007.013Vendor AdvisoryX Refsource OPENPKG
support.avaya.com/elmodocs2/security/ASA-2007-254.htmX Refsource CONFIRM
slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.492650Vendor AdvisoryX Refsource SLACKWARE
secunia.com/advisories/25571Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10094VDB EntrySignatureX Refsource OVAL
www.kb.cert.org/vuls/id/684664Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.debian.org/security/2008/dsa-1613Vendor AdvisoryX Refsource DEBIAN
sunsolve.sun.com/search/document.do?assetkey=1-26-102987-1Vendor AdvisoryX Refsource SUNALERT
sunsolve.sun.com/search/document.do?assetkey=1-66-200871-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/34388Third Party AdvisoryX Refsource SECUNIA

Show all 52 references

osvdb.org/36196VDB EntryX Refsource OSVDB
www.gentoo.org/security/en/glsa/glsa-200705-24.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/25273Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.coresecurity.com?action=item&id=2148X Refsource MISC
www.mirrorservice.org/sites/…X Refsource CONFIRMVendor Advisory
www.securityfocus.com/bid/24023VDB EntryX Refsource BID
exchange.xforce.ibmcloud.com/vulnerabilities/34340VDB EntryX Refsource XF
www.vupen.com/english/advisories/2008/0924/referencesVDB EntryX Refsource VUPEN
irrlicht.sourceforge.net/changes.txtX Refsource CONFIRM
secunia.com/advisories/25867Third Party AdvisoryX Refsource SECUNIA
sourceforge.net/project/shownotes.php?release_id=508653&group_id=5624X Refsource CONFIRMPatch
secunia.com/advisories/31168Third Party AdvisoryX Refsource SECUNIA
issues.rpath.com/browse/RPL-1381X Refsource CONFIRM
secunia.com/advisories/25329Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/25461Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/1838VDB EntryX Refsource VUPEN
secunia.com/advisories/29420Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/2385VDB EntryX Refsource VUPEN
sourceforge.net/project/shownotes.php?release_id=508656&group_id=5624X Refsource CONFIRMPatch
lists.apple.com/archives/security-announce/2008/Mar/msg00001.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/25353Third Party AdvisoryX Refsource SECUNIA
android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.htmlX Refsource CONFIRM
www.securityfocus.com/archive/1/468910/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/30161Third Party AdvisoryX Refsource SECUNIA
www.gentoo.org/security/en/glsa/glsa-200805-07.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/25554Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25268Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.debian.org/security/2009/dsa-1750Vendor AdvisoryX Refsource DEBIAN
www.securitytracker.com/id?1018078VDB EntryX Refsource SECTRACK
www.trustix.org/errata/2007/0019/Vendor AdvisoryX Refsource TRUSTIX
www.novell.com/linux/security/advisories/2007_13_sr.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/usn-472-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/27056Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-0356.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/25292Third Party AdvisoryX Refsource SECUNIAVendor Advisory
docs.info.apple.com/article.html?artnum=307562X Refsource CONFIRM
secunia.com/advisories/25787Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25742Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:116Vendor AdvisoryX Refsource MANDRIVA
www.securityfocus.com/bid/24000VDB EntryX Refsource BID
www.securityfocus.com/archive/1/489135/100/0/threadedMailing ListX Refsource BUGTRAQ
security-tracker.debian.org/tracker/CVE-2007-2445Advisory