A memory corruption flaw was found in the way applications, using the libpng library and its progressive reading method, decoded certain PNG images. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-1205)

A denial of service flaw was found in the way applications using the libpng library decoded PNG images that have certain, highly compressed ancillary chunks. An attacker could create a specially crafted PNG image that could cause an application using libpng to consume excessive amounts of memory and CPU time, and possibly crash.
(CVE-2010-0205)

A memory leak flaw was found in the way applications using the libpng library decoded PNG images that use the Physical Scale (sCAL) extension. An attacker could create a specially crafted PNG image that could cause an application using libpng to exhaust all available memory and possibly crash or exit. (CVE-2010-2249)

A sensitive information disclosure flaw was found in the way applications using the libpng library processed 1-bit interlaced PNG images. An attacker could create a specially crafted PNG image that could cause an application using libpng to disclose uninitialized memory. (CVE-2009-2042)

All running applications using libpng or libpng10 must be restarted for the update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0534 advisory.

    [2:1.2.10-7.1.el5_5.3]
    - Back-port fixes for CVE-2009-2042, CVE-2010-0205, CVE-2010-1205,       CVE-2010-2249     Resolves: #609921

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0534 advisory.

    The libpng packages contain a library of functions for creating and     manipulating PNG (Portable Network Graphics) image format files.

    A memory corruption flaw was found in the way applications, using the     libpng library and its progressive reading method, decoded certain PNG     images. An attacker could create a specially-crafted PNG image that, when     opened, could cause an application using libpng to crash or, potentially,     execute arbitrary code with the privileges of the user running the     application. (CVE-2010-1205)

    A denial of service flaw was found in the way applications using the libpng     library decoded PNG images that have certain, highly compressed ancillary     chunks. An attacker could create a specially-crafted PNG image that could     cause an application using libpng to consume excessive amounts of memory     and CPU time, and possibly crash. (CVE-2010-0205)

    A memory leak flaw was found in the way applications using the libpng     library decoded PNG images that use the Physical Scale (sCAL) extension. An     attacker could create a specially-crafted PNG image that could cause an     application using libpng to exhaust all available memory and possibly crash     or exit. (CVE-2010-2249)

    A sensitive information disclosure flaw was found in the way applications     using the libpng library processed 1-bit interlaced PNG images. An attacker     could create a specially-crafted PNG image that could cause an application     using libpng to disclose uninitialized memory. (CVE-2009-2042)

    Users of libpng and libpng10 should upgrade to these updated packages,     which contain backported patches to correct these issues. All running     applications using libpng or libpng10 must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes on the remote host is prior to version 10.2. It is, therefore, affected by multiple vulnerabilities in the WebKit, ImageIO, and libxml components. Note that these only affect iTunes for Windows.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1653 advisory.

    This advisory aggregates security fixes for the libpng SRPM in CIQ LTS 8.6. It addresses 20 CVEs:
    CVE-2026-22801, CVE-2007-2445, CVE-2007-5269, CVE-2008-1382, CVE-2008-3964, and 15 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1208, CVE-2010-1209, CVE-2010-1211, CVE-2010-1212, CVE-2010-1214, CVE-2010-1215, CVE-2010-2752, CVE-2010-2753)

A memory corruption flaw was found in the way Firefox decoded certain PNG images. An attacker could create a specially crafted PNG image that, when opened, could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1205)

Several same-origin policy bypass flaws were found in Firefox. An attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim has loaded with Firefox. (CVE-2010-0654, CVE-2010-1207, CVE-2010-1213, CVE-2010-2754)

A flaw was found in the way Firefox presented the location bar to a user. A malicious website could trick a user into thinking they are visiting the site reported by the location bar, when the page is actually content controlled by an attacker. (CVE-2010-1206)

A flaw was found in the way Firefox displayed the location bar when visiting a secure web page. A malicious server could use this flaw to present data that appears to originate from a secure server, even though it does not. (CVE-2010-2751)

A flaw was found in the way Firefox displayed certain malformed characters. A malicious web page could use this flaw to bypass certain string sanitization methods, allowing it to display malicious information to users. (CVE-2010-1210)

For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 3.6.7.

After installing the update, Firefox must be restarted for the changes to take effect.

From Red Hat Security Advisory 2010:0546 :

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SeaMonkey is an open source web browser, email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1211, CVE-2010-2753, CVE-2010-1214)

A memory corruption flaw was found in the way SeaMonkey decoded certain PNG images. An attacker could create a specially crafted PNG image that, when opened, could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. (CVE-2010-1205)

A same-origin policy bypass flaw was found in SeaMonkey. An attacker could create a malicious web page that, when viewed by a victim, could steal private data from a different website the victim has loaded with SeaMonkey. (CVE-2010-2754)

A flaw was found in the way SeaMonkey displayed the location bar when visiting a secure web page. A malicious server could use this flaw to present data that appears to originate from a secure server, even though it does not. (CVE-2010-2751)

All SeaMonkey users should upgrade to these updated packages, which correct these issues. After installing the update, SeaMonkey must be restarted for the changes to take effect.

ID	名稱	產品	系列	已發布	已更新	嚴重性
60816	Scientific Linux Security Update : libpng on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
68063	Oracle Linux 5 : libpng (ELSA-2010-0534)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
47876	RHEL 4 / 5 : libpng (RHSA-2010:0534)	Nessus	Red Hat Local Security Checks	2010/7/28	2025/3/20	critical
52535	Apple iTunes < 10.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	2011/3/3	2026/10/12	high
369917	Rocky Linux 8.6 [CIQ] Security Update: libpng / libpng-devel Multiple Vulnerabilities (ciqsa-2026_1653)	Nessus	Rocky Linux Local Security Checks	2026/10/21	2026/10/21	critical
60818	Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
68067	Oracle Linux 3 / 4 : seamonkey (ELSA-2010-0546)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high

偵測

搜尋 Plugin

high

critical

critical

high

critical

high

high