CVE-2010-1513

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Multiple integer overflows in src/image.c in Ziproxy before 3.0.1 allow remote attackers to execute arbitrary code via (1) a large JPG image, related to the jpg2bitmap function or (2) a large PNG image, related to the png2bitmap function, leading to heap-based buffer overflows.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/39941Vendor Advisory
http://secunia.com/secunia_research/2010-75/Vendor Advisory
http://www.securityfocus.com/archive/1/511424/100/0/threaded
http://ziproxy.sourceforge.net/#newsVendor Advisory
http://secunia.com/advisories/39941Vendor Advisory
http://secunia.com/secunia_research/2010-75/Vendor Advisory
http://www.securityfocus.com/archive/1/511424/100/0/threaded
http://ziproxy.sourceforge.net/#newsVendor Advisory

Timeline

Published: May 26, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-15146.0Unrestricted file upload vulnerability in TomatoCMS 2.0.6 and earlier allows remote authenticated users, with certain privileges, to execute CVE-2010-15152.6Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary w CVE-2010-15169.3Multiple integer overflows in SWFTools 0.9.1 allow remote attackers to execute arbitrary code via (1) a crafted PNG file, related to the get CVE-2010-151710.0The GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to (1) download arbitrary programs onto a client system, and execute CVE-2010-151810.0Array index error in the SetDLInfo method in the GIGABYTE Dldrv2 ActiveX control 1.4.206.11 allows remote attackers to execute arbitrary cod CVE-2010-15196.8Multiple integer overflows in glpng.c in glpng 1.45 allow context-dependent attackers to execute arbitrary code via a crafted PNG image, rel CVE-2010-15204.3Cross-site scripting (XSS) vulnerability in logout.php in TaskFreak! Original multi user before 0.6.4 allows remote attackers to inject arbi CVE-2010-15217.5SQL injection vulnerability in include/classes/tzn_user.php in TaskFreak! Original multi user before 0.6.4 allows remote attackers to execut CVE-2010-15227.5Multiple SQL injection vulnerabilities in the BookLibrary Basic (com_booklibrary) component 1.5.3 before 1.5.3_2010_06_20 for Joomla! allow CVE-2010-15239.3Multiple heap-based buffer overflows in vp6.w5s (aka the VP6 codec) in Winamp before 5.59 Beta build 3033 might allow remote attackers to ex CVE-2010-15249.3The SpreadSheet Lotus 123 reader (wkssr.dll) in Autonomy KeyView 10.4 and 10.9, as used in multiple IBM, Symantec, and other products, allow CVE-2010-15259.3Integer underflow in the SpreadSheet Lotus 123 reader (wkssr.dll) in Autonomy KeyView 10.4 and 10.9, as used in multiple IBM, Symantec, and