7.5

CVE-2015-8472: apple mac_os_x

Modified
AliasesMGASA-2015-0473UBUNTU-CVE-2015-8472DEBIAN-CVE-2015-8472
Published 21-01-2016Last modified 06-08-2024

Vulnerability summary

CVE-2015-8472 is a high (CVSS 7.5) vulnerability in apple mac_os_x. EPSS estimates a 6.05% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.3 (NVD); no exploitation reported by the 5 checked sources; EPSS 6% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
6.05%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 12
DLA-375-1DLA-410-1DSA-3443-1OPENSUSE-SU-2024:10534-1RHSA-2015:2594RHSA-2015:2595

Timeline

  1. 21-01-2016
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

6.05%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 6.05% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Mageia2 products
  • libpng< 1.6.20-1.mga5
  • libpng12< 1.2.55-1.mga5
Apple1 product
Debian1 product
  • libpng1.6< 1.6.20-1
Libpng1 product
  • libpng1.0.64 | 1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.10 | 1.2.11 | 1.2.12 | 1.2.13 | 1.2.14 | 1.2.15 | 1.2.16 | 1.2.17 | 1.2.18 | 1.2.19 | 1.2.20 | 1.2.21 | 1.2.22 | 1.2.23 | 1.2.24 | 1.2.25 | 1.2.26 | 1.2.27 | 1.2.28 | 1.2.29 | 1.2.30 | 1.2.31 | 1.2.32 | 1.2.33 | 1.2.34 | 1.2.35 | 1.2.36 | 1.2.37 | 1.2.38 | 1.2.39 | 1.2.40 | 1.2.41 | 1.2.42 | 1.2.43 | 1.2.44 | 1.2.45 | 1.2.46 | 1.2.47 | 1.2.48 | 1.2.49 | 1.2.50 | 1.2.51 | 1.2.52 | 1.2.53 | 1.2.54 | 1.4.0 | 1.4.1 | 1.4.2 | 1.4.3 | 1.4.4 | 1.4.5 | 1.4.6 | 1.4.7 | 1.4.8 | 1.4.9 | 1.4.10 | 1.4.11 | 1.4.12 | 1.4.13 | 1.4.14 | 1.4.15 | 1.4.16 | 1.4.17 | 1.5.1 | 1.5.2 | 1.5.3 | 1.5.4 | 1.5.5 | 1.5.6 | 1.5.7 | 1.5.8 | 1.5.9 | 1.5.10 | 1.5.11 | 1.5.12 | 1.5.13 | 1.5.14 | 1.5.15 | 1.5.16 | 1.5.17 | 1.5.18 | 1.5.19 | 1.5.20 | 1.5.21 | 1.5.22 | 1.5.23 | 1.5.24 | 1.6.0 | 1.6.1 | 1.6.2 | 1.6.3 | 1.6.4 | 1.6.5 | 1.6.6 | 1.6.7 | 1.6.8 | 1.6.9 | 1.6.10 | 1.6.11 | 1.6.12 | 1.6.13 | 1.6.14 | 1.6.15 | 1.6.16 | 1.6.17 | 1.6.18 | 1.6.19
Ubuntu1 product
  • libpng< 1.2.50-1ubuntu2.14.04.2

5 vendors · 6 products

References

42 links
Show all 42 references