Description
libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.
Analysis and contextual insights are available on OpenCVE Cloud.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-2032-1 | New libpng packages fix several vulnerabilities |
EUVD |
EUVD-2009-2038 | libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file. |
Ubuntu USN |
USN-913-1 | libpng vulnerabilities |
References
History
No history.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-08-07T05:36:20.484Z
Reserved: 2009-06-12T00:00:00.000Z
Link: CVE-2009-2042
No data.
Status : Modified
Published: 2009-06-12T20:30:00.203
Modified: 2026-04-23T00:35:47.467
Link: CVE-2009-2042
OpenCVE Enrichment
No data.
Weaknesses
Debian DSA
EUVD
Ubuntu USN