Vulnerability Name:

CVE-2004-0421 (CCN-16022)

Assigned:2004-04-29
Published:2004-04-29
Updated:2017-10-11
Summary:The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2004-0421

Source: APPLE
Type: UNKNOWN
APPLE-SA-2004-09-09

Source: BUGTRAQ
Type: UNKNOWN
20040429 [OpenPKG-SA-2004.017] OpenPKG Security Advisory (png)

Source: TRUSTIX
Type: UNKNOWN
2004-0025

Source: FEDORA
Type: UNKNOWN
FEDORA-2004-105

Source: FEDORA
Type: UNKNOWN
FEDORA-2004-106

Source: CCN
Type: RHSA-2004-180
libpng security update

Source: CCN
Type: RHSA-2004-181
Updated libpng packages fix crash

Source: CCN
Type: SA11505
libpng Potential Denial of Service Vulnerability

Source: SECUNIA
Type: UNKNOWN
22957

Source: SECUNIA
Type: UNKNOWN
22958

Source: CCN
Type: CIAC Information Bulletin O-212
Apple Security Update

Source: DEBIAN
Type: UNKNOWN
DSA-498

Source: DEBIAN
Type: DSA-498
libpng -- out of bound access

Source: CCN
Type: GLSA-200405-06
libpng denial of service vulnerability

Source: CCN
Type: Trustix Secure Linux Security Advisory #2004-0025
libpng proftpd

Source: CCN
Type: GLSA 200405-06
libpng denial of service vulnerability

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2004:040

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:212

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:213

Source: CCN
Type: OpenPKG-SA-2004.017
libpng

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2004:180

Source: REDHAT
Type: UNKNOWN
RHSA-2004:181

Source: BID
Type: Patch, Vendor Advisory
10244

Source: CCN
Type: BID-10244
LibPNG Broken PNG Out Of Bounds Access Denial Of Service Vulnerability

Source: CCN
Type: TLSA-2004-19
Multiple vulnerabilities in libpng

Source: XF
Type: UNKNOWN
libpng-png-dos(16022)

Source: XF
Type: UNKNOWN
libpng-png-dos(16022)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:11710

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:971

Vulnerable Configuration:Configuration 1:
  • cpe:/a:greg_roelofs:libpng:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng:1.0.14:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng3:1.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng3:1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng3:1.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng3:1.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng3:1.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:greg_roelofs:libpng3:1.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:libpng:1.2.2-16:*:i386:*:*:*:*:*
  • OR cpe:/a:redhat:libpng:1.2.2-16:*:i386_dev:*:*:*:*:*
  • OR cpe:/a:redhat:libpng:1.2.2-20:*:i386:*:*:*:*:*
  • OR cpe:/a:redhat:libpng:1.2.2-20:*:i386_dev:*:*:*:*:*
  • OR cpe:/a:redhat:libpng:10.1.0.13.8:*:i386:*:*:*:*:*
  • OR cpe:/a:redhat:libpng:10.1.0.13.8:*:i386_dev:*:*:*:*:*
  • OR cpe:/a:redhat:libpng:10.1.0.13.11:*:i386:*:*:*:*:*
  • OR cpe:/a:redhat:libpng:10.1.0.13.11:*:i386_dev:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:redhat:enterprise_linux:2.1:*:advanced_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:enterprise_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3.0:*:advanced_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3.0:*:enterprise_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3.0:*:workstation_server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1:*:ia64:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1:*:itanium_processor:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:2.0:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:2.1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:libpng:libpng:0.71:*:*:*:*:*:*:*
  • AND
  • cpe:/o:turbolinux:turbolinux:6.5:*:*:*:server:*:*:*
  • OR cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:current:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/a:mandrakesoft:mandrake_multi_network_firewall:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux_server:6.1:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:6.0:*:*:*:workstation:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:aw:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:1.3:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:2.0:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2007::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.1::ppc:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:11710
    V
    		The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message.
    2013-04-29
    oval:org.mitre.oval:def:971
    V
    		libpng Malformed PNG Image Vulnerability
    2007-04-25
    oval:com.redhat.rhsa:def:20040180
    P
    		RHSA-2004:180: libpng security update (Important)
    2004-05-19
    oval:org.debian:def:498
    V
    		out of bound access
    2004-04-30
    BACK
    greg_roelofs libpng 1.0
    greg_roelofs libpng 1.0.5
    greg_roelofs libpng 1.0.6
    greg_roelofs libpng 1.0.7
    greg_roelofs libpng 1.0.8
    greg_roelofs libpng 1.0.9
    greg_roelofs libpng 1.0.10
    greg_roelofs libpng 1.0.11
    greg_roelofs libpng 1.0.12
    greg_roelofs libpng 1.0.13
    greg_roelofs libpng 1.0.14
    greg_roelofs libpng3 1.2.0
    greg_roelofs libpng3 1.2.1
    greg_roelofs libpng3 1.2.2
    greg_roelofs libpng3 1.2.3
    greg_roelofs libpng3 1.2.4
    greg_roelofs libpng3 1.2.5
    openpkg openpkg 1.3
    openpkg openpkg 2.0
    redhat libpng 1.2.2-16
    redhat libpng 1.2.2-16
    redhat libpng 1.2.2-20
    redhat libpng 1.2.2-20
    redhat libpng 10.1.0.13.8
    redhat libpng 10.1.0.13.8
    redhat libpng 10.1.0.13.11
    redhat libpng 10.1.0.13.11
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3.0
    redhat enterprise linux 3.0
    redhat enterprise linux 3.0
    redhat enterprise linux desktop 3.0
    redhat linux advanced workstation 2.1
    redhat linux advanced workstation 2.1
    trustix secure linux 2.0
    trustix secure linux 2.1
    libpng libpng 0.71
    turbolinux turbolinux server 6.5
    debian debian linux 3.0
    openpkg openpkg current
    gentoo linux *
    mandrakesoft mandrake multi network firewall 8.2
    turbolinux turbolinux server 6.1
    turbolinux turbolinux workstation 6.0
    mandrakesoft mandrake linux corporate server 2.1
    mandrakesoft mandrake linux 9.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat linux 9.0
    redhat enterprise linux 2.1
    trustix secure linux 2.0
    openpkg openpkg 1.3
    mandrakesoft mandrake linux 9.2
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    openpkg openpkg 2.0
    trustix secure linux 2.1
    mandrakesoft mandrake linux 10.0
    redhat enterprise linux 3
    mandrakesoft mandrake linux corporate server 3.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux 2007
    mandrakesoft mandrake linux 2007
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 3.0
    mandrakesoft mandrake linux 9.1
    mandrakesoft mandrake linux 9.2
    mandrakesoft mandrake linux 10.0
    mandrakesoft mandrake linux corporate server 2.1