CVE-2009-0040: apple iphone_os Access of Uninitialized Pointer

Modified

AliasesRHSA-2009:0340

Published 22-02-2009Last modified 07-08-2024

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2009-0040 is a medium (CVSS 6.8) Access of Uninitialized Pointer vulnerability in apple iphone_os. EPSS estimates a 4.83% chance of exploitation in the next 30 days, higher than 91.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

4.83%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 4

DSA-1750-1 DSA-1830-1 OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:10230-1 OPENSUSE-SU-2024:10972-1 OPENSUSE-SU-2024:14572-1+3 more

Timeline

22-02-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

4.83%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.83% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-824Access of Uninitialized PointerThe product accesses or uses a pointer that has not been initialized.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat6 products

libpng< 2:1.2.2-29
libpng-debuginfo< 2:1.2.2-29
libpng-devel< 2:1.2.2-29
libpng10< 0:1.0.13-20
libpng10-debuginfo< 0:1.0.13-20

Show all 6

Suse3 products

Apple2 products

iphone_os< 3.0
mac_os_x< 10.5.8

Debian1 product

debian_linuxEOL4.0 | 5.0

Fedoraproject1 product

fedoraEOL9 | 10

Libpng1 product

libpng< 1.0.43 | ≥ 1.2.0, < 1.2.35

Opensuse1 product

opensuseEOL10.3 | 11.0 | 11.1

7 vendors · 15 products

References

88 links

www.redhat.com/support/errata/RHSA-2009-0315.htmlVendor AdvisoryX Refsource REDHATBroken Link
lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.htmlVendor AdvisoryX Refsource SUSEMailing List
support.apple.com/kb/HT3757X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing List
security.gentoo.org/glsa/glsa-200903-28.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.redhat.com/support/errata/RHSA-2009-0333.htmlVendor AdvisoryX Refsource REDHATBroken Link
support.apple.com/kb/HT3639X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/35386Third Party AdvisoryX Refsource SECUNIABroken Link
security.gentoo.org/glsa/glsa-201209-25.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.debian.org/security/2009/dsa-1830Vendor AdvisoryX Refsource DEBIANMailing List

Show all 88 references

www.vupen.com/english/advisories/2009/0632VDB EntryX Refsource VUPENBroken Link
www.vupen.com/english/advisories/2009/1621VDB EntryX Refsource VUPENBroken Link
www.redhat.com/support/errata/RHSA-2009-0340.htmlVendor AdvisoryX Refsource REDHATBroken Link
sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1Vendor AdvisoryX Refsource SUNALERTBroken Link
support.apple.com/kb/HT3549X Refsource CONFIRMThird Party Advisory
www.vupen.com/english/advisories/2009/1560VDB EntryX Refsource VUPENBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10316VDB EntrySignatureX Refsource OVALBroken Link
www.vupen.com/english/advisories/2009/0469VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/34388Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2009/1462VDB EntryX Refsource VUPENBroken Link
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420Vendor AdvisoryX Refsource SLACKWAREMailing List
lists.apple.com/archives/security-announce/2009/jun/msg00002.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
secunia.com/advisories/36096Third Party AdvisoryX Refsource SECUNIABroken Link
sourceforge.net/mailarchive/…Mailing ListX Refsource MLISTBroken Link
www.vmware.com/security/advisories/VMSA-2009-0007.htmlX Refsource CONFIRMThird Party Advisory
www.redhat.com/support/errata/RHSA-2009-0325.htmlVendor AdvisoryX Refsource REDHATBroken Link
sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1Vendor AdvisoryX Refsource SUNALERTBroken Link
secunia.com/advisories/35302Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/33976Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/35074Third Party AdvisoryX Refsource SECUNIABroken Link
exchange.xforce.ibmcloud.com/vulnerabilities/48819VDB EntryX Refsource XFThird Party Advisory
www.vupen.com/english/advisories/2009/1522VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/34140Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2009/1451VDB EntryX Refsource VUPENBroken Link
lists.apple.com/archives/security-announce/2009/Jun/msg00005.htmlVendor AdvisoryX Refsource APPLEMailing List
www.redhat.com/archives/fedora-package-announce/2009-March/msg00272.htmlVendor AdvisoryX Refsource FEDORAMailing List
lists.apple.com/archives/security-announce/2009/May/msg00002.htmlVendor AdvisoryX Refsource APPLEMailing List
lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing List
www.mandriva.com/security/advisories?name=MDVSA-2009:083Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/34464Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34272Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34210Third Party AdvisoryX Refsource SECUNIABroken Link
lists.apple.com/archives/security-announce/2009/Aug/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing List
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6458VDB EntrySignatureX Refsource OVALBroken Link
secunia.com/advisories/34265Third Party AdvisoryX Refsource SECUNIABroken Link
wiki.rpath.com/Advisories:rPSA-2009-0046X Refsource CONFIRMBroken Link
secunia.com/advisories/34145Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/archive/1/503912/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
secunia.com/advisories/35379Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2009/0473VDB EntryX Refsource VUPENBroken Link
www.securityfocus.com/archive/1/505990/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
secunia.com/advisories/34143Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/archives/fedora-package-announce/2009-March/msg00769.htmlVendor AdvisoryX Refsource FEDORAMailing List
www.debian.org/security/2009/dsa-1750Vendor AdvisoryX Refsource DEBIANMailing List
www.redhat.com/archives/fedora-package-announce/2009-March/msg00771.htmlVendor AdvisoryX Refsource FEDORAMailing List
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.433952Vendor AdvisoryX Refsource SLACKWAREMailing List
secunia.com/advisories/33970Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/34137Third Party AdvisoryX Refsource SECUNIABroken Link
www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
lists.vmware.com/pipermail/security-announce/2009/000062.htmlMailing ListX Refsource MLISTBroken Link
sourceforge.net/project/shownotes.php?group_id=1689&release_id=662441X Refsource CONFIRMBroken Link
secunia.com/advisories/34462Third Party AdvisoryX Refsource SECUNIABroken Link
support.avaya.com/elmodocs2/security/ASA-2009-069.htmX Refsource CONFIRMBroken Link
www.vupen.com/english/advisories/2009/1297VDB EntryX Refsource VUPENBroken Link
www.redhat.com/archives/fedora-package-announce/2009-March/msg00412.htmlVendor AdvisoryX Refsource FEDORAMailing List
downloads.sourceforge.net/libpng/libpng-1.2.34-ADVISORY.txtX Refsource CONFIRMProduct
www.kb.cert.org/vuls/id/649212Third Party AdvisoryX Refsource CERT VNBroken LinkUS Government Resource
secunia.com/advisories/34324Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/archive/1/501767/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
secunia.com/advisories/34152Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:075Vendor AdvisoryX Refsource MANDRIVABroken Link
www.securityfocus.com/bid/33990VDB EntryX Refsource BIDBroken LinkThird Party Advisory
support.apple.com/kb/HT3613X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/35258Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/bid/33827VDB EntryX Refsource BIDBroken LinkThird Party Advisory
support.avaya.com/elmodocs2/security/ASA-2009-208.htmX Refsource CONFIRMBroken Link
www.vupen.com/english/advisories/2009/2172VDB EntryX Refsource VUPENBroken Link
www.us-cert.gov/cas/techalerts/TA09-218A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.mandriva.com/security/advisories?name=MDVSA-2009:051Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/34320Third Party AdvisoryX Refsource SECUNIABroken Link
support.avaya.com/japple/…X Refsource CONFIRMBroken Link
access.redhat.com/errata/RHSA-2009:0340Advisory
bugzilla.redhat.com/show_bug.cgi?id=486355REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0340.jsonAdvisory
access.redhat.com/security/cve/CVE-2009-0040REPORT
www.cve.org/CVERecord?id=CVE-2009-0040Advisory
nvd.nist.gov/vuln/detail/CVE-2009-0040Advisory