MEDIUM
libpng arbitrary free() flaw
Published Feb 22, 2009
6.8
MEDIUMCVSS 2.0
EPSS 4.83%
Description
The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.
Affected products
No data.
Configuration 1
Configuration 3
OR
- 10.3
- 11.0
- 11.1
- 9.0
- 10.0
- 10
- 10
Configuration 4
OR
- 4.0
- 5.0
Configuration 5
OR
- 9
- 10
No data.
Red Hat Enterprise Linux 2.1
libpng-2:1.0.14-12
Fixed · RHSA-2009:0333
Red Hat Enterprise Linux 2.1
seamonkey-0:1.0.9-0.30.el2
Fixed · RHSA-2009:0325
Red Hat Enterprise Linux 3
libpng-2:1.2.2-29
Fixed · RHSA-2009:0340
Red Hat Enterprise Linux 3
libpng10-0:1.0.13-20
Fixed · RHSA-2009:0340
Red Hat Enterprise Linux 3
seamonkey-0:1.0.9-0.34.el3
Fixed · RHSA-2009:0325
Red Hat Enterprise Linux 4
firefox-0:3.0.7-1.el4
Fixed · RHSA-2009:0315
Red Hat Enterprise Linux 4
libpng-2:1.2.7-3.el4_7.2
Fixed · RHSA-2009:0333
Red Hat Enterprise Linux 4
libpng10-0:1.0.16-3.el4_7.3
Fixed · RHSA-2009:0333
Red Hat Enterprise Linux 4
seamonkey-0:1.0.9-38.el4
Fixed · RHSA-2009:0325
Red Hat Enterprise Linux 5
firefox-0:3.0.7-1.el5
Fixed · RHSA-2009:0315
Red Hat Enterprise Linux 5
libpng-2:1.2.10-7.1.el5_3.2
Fixed · RHSA-2009:0333
Red Hat Enterprise Linux 5
xulrunner-0:1.9.0.7-1.el5
Fixed · RHSA-2009:0315
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 2.1 | libpng-2:1.0.14-12 | Fixed | RHSA-2009:0333 |
| Red Hat Enterprise Linux 2.1 | seamonkey-0:1.0.9-0.30.el2 | Fixed | RHSA-2009:0325 |
| Red Hat Enterprise Linux 3 | libpng-2:1.2.2-29 | Fixed | RHSA-2009:0340 |
| Red Hat Enterprise Linux 3 | libpng10-0:1.0.13-20 | Fixed | RHSA-2009:0340 |
| Red Hat Enterprise Linux 3 | seamonkey-0:1.0.9-0.34.el3 | Fixed | RHSA-2009:0325 |
| Red Hat Enterprise Linux 4 | firefox-0:3.0.7-1.el4 | Fixed | RHSA-2009:0315 |
| Red Hat Enterprise Linux 4 | libpng-2:1.2.7-3.el4_7.2 | Fixed | RHSA-2009:0333 |
| Red Hat Enterprise Linux 4 | libpng10-0:1.0.16-3.el4_7.3 | Fixed | RHSA-2009:0333 |
| Red Hat Enterprise Linux 4 | seamonkey-0:1.0.9-38.el4 | Fixed | RHSA-2009:0325 |
| Red Hat Enterprise Linux 5 | firefox-0:3.0.7-1.el5 | Fixed | RHSA-2009:0315 |
| Red Hat Enterprise Linux 5 | libpng-2:1.2.10-7.1.el5_3.2 | Fixed | RHSA-2009:0333 |
| Red Hat Enterprise Linux 5 | xulrunner-0:1.9.0.7-1.el5 | Fixed | RHSA-2009:0315 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
6.8 MEDIUM NVD
AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
4.83% 0.04825
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
EPSS probability 0.04825
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (21 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 4.83% (0.04825) | 91.71th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.83% (0.04825) | 90.81th | v5 (v2026.06.15) |
| Jun 13, 2026 | 6.85% (0.06850) | 91.60th | v4 (v2025.03.14) |
| Jan 23, 2026 | 8.48% (0.08482) | 92.11th | v4 (v2025.03.14) |
| Jan 18, 2026 | 7.02% (0.07019) | 91.21th | v4 (v2025.03.14) |
| Dec 1, 2025 | 8.28% (0.08276) | 91.94th | v4 (v2025.03.14) |
| May 16, 2025 | 3.94% (0.03942) | 87.74th | v4 (v2025.03.14) |
| Mar 30, 2025 | 6.78% (0.06781) | 90.40th | v4 (v2025.03.14) |
| Mar 29, 2025 | 13.15% (0.13147) | 90.18th | v4 (v2025.03.14) |
| Mar 21, 2025 | 6.78% (0.06781) | 90.51th | v4 (v2025.03.14) |
| Mar 19, 2025 | 5.23% (0.05230) | 88.70th | v4 (v2025.03.14) |
| Mar 17, 2025 | 6.39% (0.06388) | 90.32th | v4 (v2025.03.14) |
| Dec 17, 2024 | 9.10% (0.09095) | 94.63th | v3 (v2023.03.01) |
| Jun 21, 2024 | 7.50% (0.07502) | 94.14th | v3 (v2023.03.01) |
| Mar 7, 2024 | 6.86% (0.06856) | 93.72th | v3 (v2023.03.01) |
| Feb 9, 2024 | 6.28% (0.06282) | 93.34th | v3 (v2023.03.01) |
| Nov 13, 2023 | 2.87% (0.02873) | 89.65th | v3 (v2023.03.01) |
| Mar 7, 2023 | 2.63% (0.02632) | 88.68th | v3 (v2023.03.01) |
| Mar 6, 2023 | 5.39% (0.05389) | 89.93th | v2 (v2022.01.01) |
| Apr 1, 2022 | 5.39% (0.05389) | 88.95th | v2 (v2022.01.01) |
| Feb 4, 2022 | 5.39% (0.05389) | 76.24th | v2 (v2022.01.01) |
Weaknesses (1)
References (86)
- ftp://ftp.simplesystems.org/pub/png/src/libpng-1.2.34-ADVISORY.txt x_refsource_CONFIRMBroken LinkVendor Advisory
- http://downloads.sourceforge.net/libpng/libpng-1.2.34-ADVISORY.txt x_refsource_CONFIRMProduct
- http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html vendor-advisoryx_refsource_APPLEMailing List
- http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html vendor-advisoryx_refsource_APPLEMailing List
- http://lists.apple.com/archives/security-announce/2009/May/msg00002.html vendor-advisoryx_refsource_APPLEMailing List
- http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html vendor-advisoryx_refsource_APPLEBroken LinkMailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html vendor-advisoryx_refsource_SUSEMailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00002.html vendor-advisoryx_refsource_SUSEMailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00009.html vendor-advisoryx_refsource_SUSEMailing List
- http://lists.vmware.com/pipermail/security-announce/2009/000062.html mailing-listx_refsource_MLISTBroken Link
- http://secunia.com/advisories/33970 third-party-advisoryx_refsource_SECUNIABroken LinkVendor Advisory
- http://secunia.com/advisories/33976 third-party-advisoryx_refsource_SECUNIABroken LinkVendor Advisory
- http://secunia.com/advisories/34137 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34140 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34143 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34145 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34152 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34210 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34265 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34272 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34320 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34324 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34388 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34462 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/34464 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/35074 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/35258 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/35302 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/35379 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/35386 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/36096 third-party-advisoryx_refsource_SECUNIABroken Link
- http://security.gentoo.org/glsa/glsa-200903-28.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://security.gentoo.org/glsa/glsa-201209-25.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.405420 vendor-advisoryx_refsource_SLACKWAREMailing List
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.433952 vendor-advisoryx_refsource_SLACKWAREMailing List
- http://sourceforge.net/mailarchive/message.php?msg_name=e56ccc8f0902181726i200f4bf0n20d919473ec409b7%40mail.gmail.com mailing-listx_refsource_MLISTBroken Link
- http://sourceforge.net/project/shownotes.php?group_id=1689&release_id=662441 x_refsource_CONFIRMBroken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1 vendor-advisoryx_refsource_SUNALERTBroken Link
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1 vendor-advisoryx_refsource_SUNALERTBroken Link
- http://support.apple.com/kb/HT3549 x_refsource_CONFIRMThird Party Advisory
- http://support.apple.com/kb/HT3613 x_refsource_CONFIRMThird Party Advisory
- http://support.apple.com/kb/HT3639 x_refsource_CONFIRMThird Party Advisory
- http://support.apple.com/kb/HT3757 x_refsource_CONFIRMThird Party Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-069.htm x_refsource_CONFIRMBroken Link
- http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm x_refsource_CONFIRMBroken Link
- http://support.avaya.com/japple/css/japple?temp.documentID=366362&temp.productID=154235&temp.releaseID=361845&temp.bucketID=126655&PAGE=Document x_refsource_CONFIRMBroken Link
- http://wiki.rpath.com/Advisories:rPSA-2009-0046 x_refsource_CONFIRMBroken Link
- http://www.debian.org/security/2009/dsa-1750 vendor-advisoryx_refsource_DEBIANMailing List
- http://www.debian.org/security/2009/dsa-1830 vendor-advisoryx_refsource_DEBIANMailing List
- http://www.kb.cert.org/vuls/id/649212 third-party-advisoryx_refsource_CERT-VNBroken LinkThird Party AdvisoryUS Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:051 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:075 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:083 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.redhat.com/support/errata/RHSA-2009-0315.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.redhat.com/support/errata/RHSA-2009-0325.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.redhat.com/support/errata/RHSA-2009-0333.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.redhat.com/support/errata/RHSA-2009-0340.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.securityfocus.com/archive/1/501767/100/0/threaded mailing-listx_refsource_BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/503912/100/0/threaded mailing-listx_refsource_BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/505990/100/0/threaded mailing-listx_refsource_BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/33827 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/33990 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- http://www.us-cert.gov/cas/techalerts/TA09-133A.html third-party-advisoryx_refsource_CERTThird Party AdvisoryUS Government Resource
- http://www.us-cert.gov/cas/techalerts/TA09-218A.html third-party-advisoryx_refsource_CERTThird Party AdvisoryUS Government Resource
- http://www.vmware.com/security/advisories/VMSA-2009-0007.html x_refsource_CONFIRMThird Party Advisory
- http://www.vupen.com/english/advisories/2009/0469 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/0473 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/0632 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/1297 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/1451 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/1462 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/1522 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/1560 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/1621 vdb-entryx_refsource_VUPENBroken Link
- http://www.vupen.com/english/advisories/2009/2172 vdb-entryx_refsource_VUPENBroken Link
- https://access.redhat.com/security/cve/CVE-2009-0040 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=486355 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48819 vdb-entryx_refsource_XFThird Party AdvisoryVDB Entry
- https://nvd.nist.gov/vuln/detail/CVE-2009-0040
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10316 vdb-entrysignaturex_refsource_OVALBroken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6458 vdb-entrysignaturex_refsource_OVALBroken Link
- https://www.cve.org/CVERecord?id=CVE-2009-0040
- https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00272.html vendor-advisoryx_refsource_FEDORAMailing List
- https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00412.html vendor-advisoryx_refsource_FEDORAMailing List
- https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00769.html vendor-advisoryx_refsource_FEDORAMailing List
- https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00771.html vendor-advisoryx_refsource_FEDORAMailing List
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Feb 22, 2009
Updated Aug 7, 2024
Reserved Dec 15, 2008
Link CVE-2009-0040
CISA Vulnrichment
Updated n/a