Vulnerability in Libpng
CVE-2014-0333
The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.
EPSS: 0.033 (87.3th percentile) — read the EPSS interpretation.
Affected products
- Libpng — versions 1.6.0, 1.6.1, 1.6.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (x_refsource_CONFIRM)
- cret@cert.org (vendor-advisory, x_refsource_SUSE)
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, Patch, third-party-advisory)