ByteOS Network

Vulnerability Details :

CVE-2015-0973

Assigner-certcc

Assigner Org ID-37e5125f-f79b-445b-8fad-9564f167944b

Published At-18 Jan, 2015 | 18:00

Updated At-09 Jun, 2025 | 15:25

Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:certcc

Assigner Org ID:37e5125f-f79b-445b-8fad-9564f167944b

Published At:18 Jan, 2015 | 18:00

Updated At:09 Jun, 2025 | 15:25

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	vendor-advisory
https://support.apple.com/HT206167	N/A
http://sourceforge.net/p/png-mng/mailman/message/33173461/	mailing-list
http://www.openwall.com/lists/oss-security/2015/01/10/1	mailing-list
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html	N/A
http://www.openwall.com/lists/oss-security/2015/01/10/3	mailing-list
http://secunia.com/advisories/62725	third-party-advisory
http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt	N/A
https://security.netapp.com/advisory/ntap-20240719-0005/	N/A

Hyperlink: http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

Resource:

vendor-advisory

Hyperlink: https://support.apple.com/HT206167

Resource: N/A

Hyperlink: http://sourceforge.net/p/png-mng/mailman/message/33173461/

Resource:

mailing-list

Hyperlink: http://www.openwall.com/lists/oss-security/2015/01/10/1

Resource:

mailing-list

Hyperlink: http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Resource: N/A

Hyperlink: http://www.openwall.com/lists/oss-security/2015/01/10/3

Resource:

mailing-list

Hyperlink: http://secunia.com/advisories/62725

Resource:

third-party-advisory

Hyperlink: http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt

Resource: N/A

Hyperlink: https://security.netapp.com/advisory/ntap-20240719-0005/

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	vendor-advisory x_transferred
https://support.apple.com/HT206167	x_transferred
http://sourceforge.net/p/png-mng/mailman/message/33173461/	mailing-list x_transferred
http://www.openwall.com/lists/oss-security/2015/01/10/1	mailing-list x_transferred
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html	x_transferred
http://www.openwall.com/lists/oss-security/2015/01/10/3	mailing-list x_transferred
http://secunia.com/advisories/62725	third-party-advisory x_transferred
http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt	x_transferred
https://security.netapp.com/advisory/ntap-20240719-0005/	x_transferred

Hyperlink: http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

Resource:

vendor-advisory

x_transferred

Hyperlink: https://support.apple.com/HT206167

Resource:

x_transferred

Hyperlink: http://sourceforge.net/p/png-mng/mailman/message/33173461/

Resource:

mailing-list

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2015/01/10/1

Resource:

mailing-list

x_transferred

Hyperlink: http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Resource:

x_transferred

Hyperlink: http://www.openwall.com/lists/oss-security/2015/01/10/3

Resource:

mailing-list

x_transferred

Hyperlink: http://secunia.com/advisories/62725

Resource:

third-party-advisory

x_transferred

Hyperlink: http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt

Resource:

x_transferred

Hyperlink: https://security.netapp.com/advisory/ntap-20240719-0005/

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-120	CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Type: CWE

CWE ID: CWE-120

Description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

Version	Base score	Base severity	Vector
3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cret@cert.org

Published At:18 Jan, 2015 | 18:59

Updated At:09 Jun, 2025 | 16:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Secondary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

Oracle Corporation

>>solaris>>11.2

cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*

libpng>>libpng>>Versions up to 1.5.20(inclusive)

cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*

libpng>>libpng>>1.6.0

cpe:2.3:a:libpng:libpng:1.6.0:*:*:*:*:*:*:*

libpng>>libpng>>1.6.0

cpe:2.3:a:libpng:libpng:1.6.0:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.1

cpe:2.3:a:libpng:libpng:1.6.1:*:*:*:*:*:*:*

libpng>>libpng>>1.6.1

cpe:2.3:a:libpng:libpng:1.6.1:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.2

cpe:2.3:a:libpng:libpng:1.6.2:*:*:*:*:*:*:*

libpng>>libpng>>1.6.2

cpe:2.3:a:libpng:libpng:1.6.2:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.3

cpe:2.3:a:libpng:libpng:1.6.3:*:*:*:*:*:*:*

libpng>>libpng>>1.6.3

cpe:2.3:a:libpng:libpng:1.6.3:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.4

cpe:2.3:a:libpng:libpng:1.6.4:*:*:*:*:*:*:*

libpng>>libpng>>1.6.4

cpe:2.3:a:libpng:libpng:1.6.4:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.5

cpe:2.3:a:libpng:libpng:1.6.5:*:*:*:*:*:*:*

libpng>>libpng>>1.6.6

cpe:2.3:a:libpng:libpng:1.6.6:*:*:*:*:*:*:*

libpng>>libpng>>1.6.7

cpe:2.3:a:libpng:libpng:1.6.7:*:*:*:*:*:*:*

libpng>>libpng>>1.6.7

cpe:2.3:a:libpng:libpng:1.6.7:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.8

cpe:2.3:a:libpng:libpng:1.6.8:*:*:*:*:*:*:*

libpng>>libpng>>1.6.8

cpe:2.3:a:libpng:libpng:1.6.8:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.9

cpe:2.3:a:libpng:libpng:1.6.9:*:*:*:*:*:*:*

libpng>>libpng>>1.6.9

cpe:2.3:a:libpng:libpng:1.6.9:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.10

cpe:2.3:a:libpng:libpng:1.6.10:*:*:*:*:*:*:*

libpng>>libpng>>1.6.10

cpe:2.3:a:libpng:libpng:1.6.10:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.11

cpe:2.3:a:libpng:libpng:1.6.11:*:*:*:*:*:*:*

libpng>>libpng>>1.6.11

cpe:2.3:a:libpng:libpng:1.6.11:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.12

cpe:2.3:a:libpng:libpng:1.6.12:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.13

cpe:2.3:a:libpng:libpng:1.6.13:*:*:*:*:*:*:*

libpng>>libpng>>1.6.13

cpe:2.3:a:libpng:libpng:1.6.13:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.14

cpe:2.3:a:libpng:libpng:1.6.14:*:*:*:*:*:*:*

libpng>>libpng>>1.6.14

cpe:2.3:a:libpng:libpng:1.6.14:beta:*:*:*:*:*:*

libpng>>libpng>>1.6.15

cpe:2.3:a:libpng:libpng:1.6.15:*:*:*:*:*:*:*

libpng>>libpng>>1.6.15

cpe:2.3:a:libpng:libpng:1.6.15:beta:*:*:*:*:*:*

Apple Inc.

>>mac_os_x>>Versions up to 10.11.3(inclusive)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-119	Primary	nvd@nist.gov
CWE-120	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-119

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-120

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	cret@cert.org	Vendor Advisory
http://secunia.com/advisories/62725	cret@cert.org	Permissions Required Third Party Advisory
http://sourceforge.net/p/png-mng/mailman/message/33173461/	cret@cert.org	Third Party Advisory
http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt	cret@cert.org	Exploit
http://www.openwall.com/lists/oss-security/2015/01/10/1	cret@cert.org	Exploit Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/01/10/3	cret@cert.org	Exploit
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html	cret@cert.org	Third Party Advisory
https://security.netapp.com/advisory/ntap-20240719-0005/	cret@cert.org	N/A
https://support.apple.com/HT206167	cret@cert.org	Vendor Advisory
http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
http://secunia.com/advisories/62725	af854a3a-2127-422b-91ae-364da2661108	Permissions Required Third Party Advisory
http://sourceforge.net/p/png-mng/mailman/message/33173461/	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://www.openwall.com/lists/oss-security/2015/01/10/1	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/01/10/3	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://security.netapp.com/advisory/ntap-20240719-0005/	af854a3a-2127-422b-91ae-364da2661108	N/A
https://support.apple.com/HT206167	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

Source: cret@cert.org

Resource:

Vendor Advisory

Hyperlink: http://secunia.com/advisories/62725

Source: cret@cert.org

Resource:

Permissions Required

Third Party Advisory

Hyperlink: http://sourceforge.net/p/png-mng/mailman/message/33173461/

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt

Source: cret@cert.org

Resource:

Exploit

Hyperlink: http://www.openwall.com/lists/oss-security/2015/01/10/1

Source: cret@cert.org

Resource:

Exploit

Third Party Advisory

Hyperlink: http://www.openwall.com/lists/oss-security/2015/01/10/3

Source: cret@cert.org

Resource:

Exploit

Hyperlink: http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Source: cret@cert.org

Resource:

Third Party Advisory

Hyperlink: https://security.netapp.com/advisory/ntap-20240719-0005/

Source: cret@cert.org

Resource: N/A

Hyperlink: https://support.apple.com/HT206167

Source: cret@cert.org

Resource:

Vendor Advisory

Hyperlink: http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html