CVE-2015-2158

HIGH 7.8CVE-2015-2158 · Published 06/10/2017 · updated 17/06/2026

In short

CVE-2015-2158 is a HIGH (CVSS 7.8) vulnerability affecting pngcrush (pngcrush project).
Chance of exploitation in the next 30 days (EPSS): 2.9%, higher than 86.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pngcrush pngcrush_project	`≤ 1.7.83`	No fix yet

Description

Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.

References

openwall.com/lists/oss-security/2015/03/01/1 · Mailing List
securityfocus.com/bid/72830 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released · Patch

More vulnerabilities in pngcrush

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free