CVE-2010-2249

CVE Database · CVE-2010-2249

CVE-2010-2249

· MEDIUMModified

CVSS v3.1

6.5

EPSS

2.63%

Published

Jun 30, 2010

Modified

Apr 28, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-401

Affected Products (24)

libpng · libpng (up to 1.2.44)vulnerable

libpng · libpng (up to 1.4.3)vulnerable

apple · itunes (up to 10.2)vulnerable

apple · safari (up to 5.0.4)vulnerable

apple · iphone_osvulnerable

apple · tvos (up to 4.1.0)vulnerable

fedoraproject · fedoravulnerable

opensuse · opensusevulnerable

References (20)

http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commitdiff%3Bh=90cfcecc09febb8d6c8c1d37ea7bb7cf0f4b00f3#patch20

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html

Mailing ListThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs