CVE-2010-0205: apple mac_os_x Uncontrolled Resource Consumption

Modified

Published 03-03-2010Last modified 07-08-2024

Vulnerability summary

CVE-2010-0205 is a medium (CVSS 4.3) Uncontrolled Resource Consumption vulnerability in apple mac_os_x. EPSS estimates a 4.50% chance of exploitation in the next 30 days, higher than 91.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

4.50%

0%100%

Low · +0.32 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

DSA-2032-1 RHSA-2010:0534

Timeline

03-03-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

4.50%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

Increase +0.32 pp

From 4.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apple1 product

mac_os_x< 10.6.5

Canonical1 product

ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04 | 9.10

Debian1 product

debian_linuxEOL5.0 | 6.0

Fedoraproject1 product

fedoraEOL11 | 12 | 13

Libpng1 product

libpng≥ 1.0.0, < 1.0.53 | ≥ 1.2.0, < 1.2.43 | ≥ 1.4.0, < 1.4.1

Opensuse1 product

opensuseEOL11.0 | 11.1 | 11.2

Suse1 product

linux_enterprise_server9 | 10:sp3 | 11 | 11:sp1

7 vendors · 7 products

References

35 links

www.vmware.com/security/advisories/VMSA-2010-0014.htmlX Refsource CONFIRMThird Party Advisory
www.vupen.com/english/advisories/2010/0517VDB EntryX Refsource VUPENThird Party Advisory
www.vupen.com/english/advisories/2010/0682VDB EntryX Refsource VUPENThird Party Advisory
support.apple.com/kb/HT4435X Refsource CONFIRMBroken Link
osvdb.org/62670VDB EntryX Refsource OSVDBBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2010:063Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.vupen.com/english/advisories/2010/0605VDB EntryX Refsource VUPENThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2010-March/037364.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.vupen.com/english/advisories/2010/0626VDB EntryX Refsource VUPENThird Party Advisory
www.vupen.com/english/advisories/2010/0686VDB EntryX Refsource VUPENThird Party Advisory

Show all 35 references

secunia.com/advisories/39251Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2010/1107VDB EntryX Refsource VUPENThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2010:064Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/56661VDB EntryX Refsource XFThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
ubuntu.com/usn/usn-913-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing List
www.debian.org/security/2010/dsa-2032Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/41574Third Party AdvisoryX Refsource SECUNIA
lists.vmware.com/pipermail/security-announce/2010/000105.htmlMailing ListX Refsource MLISTThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2010-March/037355.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/38774Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.vupen.com/english/advisories/2010/0637VDB EntryX Refsource VUPENThird Party Advisory
www.kb.cert.org/vuls/id/576029Third Party AdvisoryX Refsource CERT VNUS Government Resource
lists.fedoraproject.org/pipermail/package-announce/2010-March/037607.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.securityfocus.com/bid/38478VDB EntryX Refsource BIDPatchThird Party Advisory
www.vupen.com/english/advisories/2010/2491VDB EntryX Refsource VUPENThird Party Advisory
libpng.sourceforge.net/ADVISORY-1.4.1.htmlX Refsource CONFIRMThird Party Advisory
www.securitytracker.com/id?1023674VDB EntryX Refsource SECTRACKThird Party Advisory
www.vupen.com/english/advisories/2010/0847VDB EntryX Refsource VUPENThird Party Advisory
www.vupen.com/english/advisories/2010/0667VDB EntryX Refsource VUPENThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2010-March/037237.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
libpng.sourceforge.net/decompression_bombs.htmlX Refsource CONFIRMThird Party Advisory