OptiPNG contained a bug in the GIF handling code that allowed to use already freed ressources. CVE-2009-0749 has been assigned to this issue.

Specially crafted BMP files could overflow a buffer in optipng (CVE-2008-5101), specially crafted GIF files could crash optipng (CVE-2009-0749).

The remote host is affected by the vulnerability described in GLSA-200903-12 (OptiPNG: User-assisted execution of arbitrary code)

    Roy Tam reported a use-after-free vulnerability in the     GIFReadNextExtension() function in lib/pngxtern/gif/gifread.c leading     to a memory corruption when reading a GIF image.
  Impact :

    A remote attacker could entice a user to process a specially crafted     GIF image, possibly resulting in the execution of arbitrary code with     the privileges of the user running the application, or a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
40292	openSUSE Security Update : optipng (optipng-972)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
40097	openSUSE Security Update : optipng (optipng-972)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
40291	openSUSE Security Update : optipng (optipng-572)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
35810	GLSA-200903-12 : OptiPNG: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2009/3/10	2021/1/6	high
35784	openSUSE 10 Security Update : optipng (optipng-6038)	Nessus	SuSE Local Security Checks	2009/3/6	2021/1/14	high
39361	openSUSE 10 Security Update : optipng (optipng-6290)	Nessus	SuSE Local Security Checks	2009/6/11	2021/1/14	high
40096	openSUSE Security Update : optipng (optipng-572)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high