CVE-2009-5063

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length. NOTE: this is due to an incomplete fix for CVE-2006-7244.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=948ee23a2a400672b1751cfc646a7467741e9b2e#patch18
http://secunia.com/advisories/49660Broken Link
http://security.gentoo.org/glsa/glsa-201206-15.xmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2011/03/22/7Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2011/03/28/6Mailing List, Patch, Third Party Advisory
http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=948ee23a2a400672b1751cfc646a7467741e9b2e#patch18
http://secunia.com/advisories/49660Broken Link
http://security.gentoo.org/glsa/glsa-201206-15.xmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2011/03/22/7Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2011/03/28/6Mailing List, Patch, Third Party Advisory

Timeline

Published: Aug 31, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-50646.9ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file link CVE-2009-50654.3Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows r CVE-2009-50662.1twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the crede CVE-2009-50674.3Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include CVE-2009-50687.2There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF depl CVE-2009-507110.0Unspecified vulnerability in Palm Pre WebOS before 1.2.1 has unknown impact and attack vectors related to an "included contact template file CVE-2009-50724.0Memory leak in the ldap_explode_dn function in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.61 (aka 6.0.0.8-TIV-ITDS-IF0003) allows re CVE-2009-50734.0IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.59 (aka 6.0.0.8-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of s CVE-2009-507410.0Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vecto CVE-2009-50754.3Monkey's Audio before 4.02 allows remote attackers to cause a denial of service (application crash) via a malformed APE file.CVE-2009-50767.5CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator CVE-2009-50777.5CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modifie