CVE-2009-0749

HIGH 7.8CVE-2009-0749 · Published 02/03/2009 · updated 16/06/2026

In short

CVE-2009-0749 is a HIGH (CVSS 7.8) vulnerability affecting optipng (optipng project).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
optipng optipng_project	`≤ 0.6.2`	No fix yet

Description

Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted GIF image that causes the realloc function to return a new pointer, which triggers memory corruption when the old pointer is accessed.

References

lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html · Mailing List
optipng.sourceforge.net · Product
secunia.com/advisories/34035 · Broken Link
secunia.com/advisories/34201 · Broken Link
secunia.com/advisories/34259 · Broken Link
secunia.com/advisories/35685 · Broken Link
sourceforge.net/tracker/index.php · Issue Tracking
gentoo.org/security/en/glsa/glsa-200903-12.xml · Third Party Advisory
openwall.com/lists/oss-security/2009/02/24/2 · Mailing List
openwall.com/lists/oss-security/2009/02/25/4 · Mailing List
securityfocus.com/bid/33873

More vulnerabilities in optipng

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

optipng

optipng_project

≤ 0.6.2

No fix yet

Description

More vulnerabilities in optipng

See all →