CVE-2009-0749: opensuse Use After Free
Vulnerability summary
CVE-2009-0749 is a high (CVSS 9.3) Use After Free vulnerability in opensuse. EPSS estimates a 1.55% chance of exploitation in the next 30 days, higher than 74.9% of scored vulnerabilities.
Timeline
- 02-03-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted GIF image that causes the realloc function to return a new pointer, which triggers memory corruption when the old pointer is accessed.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.55%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
0.00 pp
From 1.55% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- optipng< 0.6.2.1-1
Opensuse1 product
- opensuse≥ 10.3, ≤ 11.1
Optipng_project1 product
- optipng≤ 0.6.2
Suse1 product
- linux_enterprise9-11
4 vendors · 4 products
References
15 links- lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing List
- sourceforge.net/tracker/index.php?func=detail&aid=2582013&group_id=151404&atid=780913X Refsource CONFIRMIssue Tracking
- lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing List
Show all 15 references
- www.gentoo.org/security/en/glsa/glsa-200903-12.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
