CVE-2008-1382: libpng Numeric Errors

CVSS: 7.5v2.0HighModified

Published 14-04-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-1382 is a high (CVSS 7.5) Numeric Errors vulnerability in libpng. EPSS estimates a 5.51% chance of exploitation in the next 30 days, higher than 92.7% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

5.51%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Duplicates 1

RHSA-2009:0333 CVE-2007-6070

Timeline

14-04-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

5.51%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

0.00 pp

From 5.51% on 19-09-2026

19-09-202619-10-2026

EPSS score

5.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-189Numeric ErrorsWeaknesses in this category are related to improper calculation or conversion of numbers.

Affected systems

Libpng1 product

libpng1.0.6:a | 1.0.6:d | 1.0.6:e | 1.0.6:f | 1.0.6:g | 1.0.6:h | 1.0.6:i | 1.0.6:j | 1.0.7:beta11 | 1.0.7:beta12 | 1.0.7:beta13 | 1.0.7:beta14 | 1.0.7:beta15 | 1.0.7:beta16 | 1.0.7:beta17 | 1.0.7:beta18 | 1.0.7:rc1 | 1.0.7:rc2 | 1.0.8:beta1 | 1.0.8:beta2 | 1.0.8:beta3 | 1.0.8:beta4 | 1.0.8:rc1 | 1.0.9:beta1 | 1.0.9:beta10 | 1.0.9:beta2 | 1.0.9:beta3 | 1.0.9:beta4 | 1.0.9:beta5 | 1.0.9:beta6 | 1.0.9:beta7 | 1.0.9:beta8 | 1.0.9:beta9 | 1.0.9:rc1 | 1.0.9:rc2 | 1.0.10:beta1 | 1.0.10:rc1 | 1.0.11:beta1 | 1.0.11:beta2 | 1.0.11:beta3 | 1.0.11:rc1 | 1.0.12 | 1.0.12:beta1 | 1.0.12:rc1 | 1.0.13 | 1.0.14 | 1.0.15 | 1.0.15:rc1 | 1.0.15:rc2 | 1.0.15:rc3 | 1.0.16 | 1.0.17 | 1.0.18 | 1.0.19 | 1.0.19:rc1 | 1.0.19:rc2 | 1.0.19:rc3 | 1.0.19:rc5 | 1.0.20 | 1.0.21 | 1.0.21:rc1 | 1.0.21:rc2 | 1.0.22 | 1.0.22:rc1 | 1.0.23 | 1.0.23:rc1 | 1.0.23:rc2 | 1.0.23:rc3 | 1.0.23:rc4 | 1.0.23:rc5 | 1.0.24 | 1.0.24:rc1 | 1.0.25 | 1.0.25:rc1 | 1.0.25:rc2 | 1.0.26 | 1.0.27 | 1.0.27:rc1 | 1.0.27:rc2 | 1.0.27:rc3 | 1.0.27:rc4 | 1.0.27:rc5 | 1.0.27:rc6 | 1.0.28 | 1.0.28:rc2 | 1.0.28:rc3 | 1.0.28:rc4 | 1.0.28:rc5 | 1.0.28:rc6 | 1.0.29 | 1.0.29:beta1 | 1.0.29:rc1 | 1.0.29:rc2 | 1.0.29:rc3 | 1.0.30 | 1.0.30:rc1 | 1.0.31 | 1.0.31:rc01 | 1.0.32 | 1.2.0:beta1 | 1.2.0:beta2 | 1.2.0:beta3 | 1.2.0:beta4 | 1.2.0:beta5 | 1.2.0:rc1 | 1.2.1:beta1 | 1.2.1:beta2 | 1.2.1:beta3 | 1.2.1:beta4 | 1.2.1:rc1 | 1.2.1:rc2 | 1.2.2:beta1 | 1.2.2:beta2 | 1.2.2:beta3 | 1.2.2:beta4 | 1.2.2:beta5 | 1.2.2:beta6 | 1.2.2:rc1 | 1.2.3:rc1 | 1.2.3:rc2 | 1.2.3:rc3 | 1.2.3:rc4 | 1.2.3:rc5 | 1.2.3:rc6 | 1.2.4:beta1 | 1.2.4:beta2 | 1.2.4:beta3 | 1.2.4:rc1 | 1.2.5:beta1 | 1.2.5:beta2 | 1.2.5:rc1 | 1.2.5:rc2 | 1.2.5:rc3 | 1.2.6:beta1 | 1.2.6:beta2 | 1.2.6:beta3 | 1.2.6:beta4 | 1.2.6:rc1 | 1.2.6:rc2 | 1.2.6:rc3 | 1.2.6:rc4 | 1.2.6:rc5 | 1.2.7:beta1 | 1.2.7:beta2 | 1.2.8:beta1 | 1.2.8:beta2 | 1.2.8:beta3 | 1.2.8:beta4 | 1.2.8:beta5 | 1.2.8:rc1 | 1.2.8:rc2 | 1.2.8:rc3 | 1.2.8:rc4 | 1.2.8:rc5 | 1.2.9:beta1 | 1.2.9:beta10 | 1.2.9:beta2 | 1.2.9:beta3 | 1.2.9:beta4 | 1.2.9:beta5 | 1.2.9:beta6 | 1.2.9:beta7 | 1.2.9:beta8 | 1.2.9:beta9 | 1.2.9:rc1 | 1.2.10:beta1 | 1.2.10:beta2 | 1.2.10:beta3 | 1.2.10:beta4 | 1.2.10:beta5 | 1.2.10:beta6 | 1.2.10:beta7 | 1.2.10:rc1 | 1.2.10:rc2 | 1.2.10:rc3 | 1.2.11:beta1 | 1.2.11:beta2 | 1.2.11:beta3 | 1.2.11:beta4 | 1.2.11:rc1 | 1.2.11:rc2 | 1.2.11:rc3 | 1.2.11:rc5 | 1.2.13:beta1 | 1.2.13:rc1 | 1.2.13:rc2 | 1.2.14:beta1 | 1.2.14:beta2 | 1.2.14:rc1 | 1.2.15:beta1 | 1.2.15:beta2 | 1.2.15:beta3 | 1.2.15:beta4 | 1.2.15:beta5 | 1.2.15:beta6 | 1.2.15:rc1 | 1.2.15:rc2 | 1.2.15:rc3 | 1.2.15:rc4 | 1.2.15:rc5 | 1.2.16:beta1 | 1.2.16:beta2 | 1.2.16:rc1 | 1.2.17:beta1 | 1.2.17:beta2 | 1.2.17:rc1 | 1.2.17:rc2 | 1.2.17:rc3 | 1.2.17:rc4 | 1.2.19:beta1 | 1.2.19:beta10 | 1.2.19:beta11 | 1.2.19:beta12 | 1.2.19:beta13 | 1.2.19:beta14 | 1.2.19:beta15 | 1.2.19:beta16 | 1.2.19:beta17 | 1.2.19:beta18 | 1.2.19:beta19 | 1.2.19:beta2 | 1.2.19:beta20 | 1.2.19:beta21 | 1.2.19:beta22 | 1.2.19:beta23 | 1.2.19:beta24 | 1.2.19:beta25 | 1.2.19:beta26 | 1.2.19:beta27 | 1.2.19:beta28 | 1.2.19:beta29 | 1.2.19:beta3 | 1.2.19:beta30 | 1.2.19:beta31 | 1.2.19:beta4 | 1.2.19:beta5 | 1.2.19:beta6 | 1.2.19:beta7 | 1.2.19:beta8 | 1.2.19:beta9 | 1.2.19:rc1 | 1.2.19:rc2 | 1.2.19:rc3 | 1.2.19:rc4 | 1.2.19:rc5 | 1.2.19:rc6 | 1.2.20:beta01 | 1.2.20:beta02 | 1.2.20:beta03 | 1.2.20:beta04 | 1.2.20:rc1 | 1.2.20:rc2 | 1.2.20:rc3 | 1.2.20:rc4 | 1.2.20:rc5 | 1.2.20:rc6 | 1.2.21:rc3 | 1.2.22:beta1 | 1.2.22:beta2 | 1.2.22:beta2-1.2.21 | 1.2.22:beta3 | 1.2.22:beta3-1.2.21 | 1.2.22:beta4 | 1.2.22:beta4-1.2.21 | 1.2.22:rc1 | 1.2.22:rc1-1.2.21 | 1.2.23:beta01 | 1.2.23:beta02 | 1.2.23:beta03 | 1.2.23:beta04 | 1.2.23:beta05 | 1.2.23:rc01 | 1.2.24:beta01 | 1.2.24:beta02 | 1.2.24:beta03 | 1.2.24:rc01 | 1.2.25:beta01 | 1.2.25:beta02 | 1.2.25:beta03 | 1.2.25:beta04 | 1.2.25:beta05 | 1.2.25:beta06 | 1.2.25:rc01 | 1.2.25:rc02 | 1.2.26:beta01 | 1.2.26:beta02 | 1.2.26:beta03 | 1.2.26:beta04 | 1.2.26:beta05 | 1.2.26:beta06 | 1.2.26:rc01 | 1.4:beta1 | 1.4:beta10 | 1.4:beta11 | 1.4:beta12 | 1.4:beta13 | 1.4:beta14 | 1.4:beta15 | 1.4:beta16 | 1.4:beta17 | 1.4:beta18 | 1.4:beta19 | 1.4:beta2 | 1.4:beta3 | 1.4:beta4 | 1.4:beta5 | 1.4:beta6 | 1.4:beta7 | 1.4:beta8 | 1.4:beta9

1 vendor · 1 product

References

58 links

lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.htmlVendor AdvisoryX Refsource SUSE
www.redhat.com/support/errata/RHSA-2009-0333.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/35386Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/1225/referencesVDB EntryX Refsource VUPEN
secunia.com/advisories/30157Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30174Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1Vendor AdvisoryX Refsource SUNALERT
support.apple.com/kb/HT3549X Refsource CONFIRM
lists.apple.com/archives/security-announce//2008/Sep/msg00005.htmlVendor AdvisoryX Refsource APPLE
www.osvdb.org/44364VDB EntryX Refsource OSVDB

Show all 58 references

www.vupen.com/english/advisories/2009/1560VDB EntryX Refsource VUPEN
secunia.com/advisories/34388Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2009/1462VDB EntryX Refsource VUPEN
security.gentoo.org/glsa/glsa-200805-10.xmlVendor AdvisoryX Refsource GENTOO
www.redhat.com/archives/fedora-package-announce/2008-June/msg00080.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/archives/fedora-package-announce/2008-May/msg00960.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/30486Third Party AdvisoryX Refsource SECUNIA
wiki.rpath.com/wiki/Advisories:rPSA-2008-0151X Refsource CONFIRM
www.vmware.com/security/advisories/VMSA-2009-0007.htmlX Refsource CONFIRM
www.us-cert.gov/cas/techalerts/TA08-260A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/30402Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/35302Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-June/msg00033.htmlVendor AdvisoryX Refsource FEDORA
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.541247Vendor AdvisoryX Refsource SLACKWARE
www.securityfocus.com/archive/1/491424/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/35074Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/2584VDB EntryX Refsource VUPEN
secunia.com/advisories/29792Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id?1019840VDB EntryX Refsource SECTRACK
www.vupen.com/english/advisories/2009/1451VDB EntryX Refsource VUPEN
lists.apple.com/archives/security-announce/2009/May/msg00002.htmlVendor AdvisoryX Refsource APPLE
secunia.com/advisories/31882Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200804-15.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/29992Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-May/msg00721.htmlVendor AdvisoryX Refsource FEDORA
www.securityfocus.com/archive/1/503912/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/29678Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/41800VDB EntryX Refsource XF
security.gentoo.org/glsa/glsa-200812-15.xmlVendor AdvisoryX Refsource GENTOO
www.debian.org/security/2009/dsa-1750Vendor AdvisoryX Refsource DEBIAN
www.ocert.org/advisories/ocert-2008-003.htmlX Refsource MISC
www.securityfocus.com/archive/1/490823/100/0/threadedMailing ListX Refsource BUGTRAQ
libpng.sourceforge.net/Advisory-1.2.26.txtX Refsource CONFIRM
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10326VDB EntrySignatureX Refsource OVAL
www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.vupen.com/english/advisories/2009/1297VDB EntryX Refsource VUPEN
secunia.com/advisories/33137Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6275VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/34152Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDVSA-2008:156Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/35258Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/30009Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/28770VDB EntryX Refsource BID
support.avaya.com/elmodocs2/security/ASA-2009-208.htmX Refsource CONFIRM
secunia.com/advisories/29957Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-May/msg00951.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/archives/fedora-package-announce/2008-June/msg00111.htmlVendor AdvisoryX Refsource FEDORA

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities