Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2010-0205 Details

Description

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://libpng.sourceforge.net/ADVISORY-1.4.1.html	CVE	Third Party Advisory
http://libpng.sourceforge.net/decompression_bombs.html	CVE	Third Party Advisory
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html	CVE	Mailing ListThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037237.html	CVE	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037355.html	CVE	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037364.html	CVE	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037607.html	CVE	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html	CVE	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html	CVE	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html	CVE	Mailing List
http://lists.vmware.com/pipermail/security-announce/2010/000105.html	CVE	Third Party Advisory
http://osvdb.org/62670	CVE	Broken Link
http://secunia.com/advisories/38774	CVE	Third Party Advisory
http://secunia.com/advisories/39251	CVE	Third Party Advisory
http://secunia.com/advisories/41574	CVE	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56661	CVE	Third Party AdvisoryVDB Entry
http://support.apple.com/kb/HT4435	CVE	Broken Link
http://ubuntu.com/usn/usn-913-1	CVE	Third Party Advisory
http://www.debian.org/security/2010/dsa-2032	CVE	Third Party Advisory
http://www.kb.cert.org/vuls/id/576029	CVE	Third Party AdvisoryUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2010:063	CVE	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:064	CVE	Third Party Advisory
http://www.securityfocus.com/bid/38478	CVE	PatchThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1023674	CVE	Third Party AdvisoryVDB Entry
http://www.vmware.com/security/advisories/VMSA-2010-0014.html	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0517	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0605	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0626	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0637	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0667	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0682	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0686	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0847	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/1107	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2010/2491	CVE	Third Party Advisory
http://libpng.sourceforge.net/ADVISORY-1.4.1.html	[email protected]	Third Party Advisory
http://libpng.sourceforge.net/decompression_bombs.html	[email protected]	Third Party Advisory
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html	[email protected]	Mailing ListThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037237.html	[email protected]	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037355.html	[email protected]	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037364.html	[email protected]	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/037607.html	[email protected]	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html	[email protected]	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html	[email protected]	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html	[email protected]	Mailing List
http://lists.vmware.com/pipermail/security-announce/2010/000105.html	[email protected]	Third Party Advisory
http://osvdb.org/62670	[email protected]	Broken Link
http://secunia.com/advisories/38774	[email protected]	Third Party Advisory
http://secunia.com/advisories/39251	[email protected]	Third Party Advisory
http://secunia.com/advisories/41574	[email protected]	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/56661	[email protected]	Third Party AdvisoryVDB Entry
http://support.apple.com/kb/HT4435	[email protected]	Broken Link
http://ubuntu.com/usn/usn-913-1	[email protected]	Third Party Advisory
http://www.debian.org/security/2010/dsa-2032	[email protected]	Third Party Advisory
http://www.kb.cert.org/vuls/id/576029	[email protected]	Third Party AdvisoryUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2010:063	[email protected]	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:064	[email protected]	Third Party Advisory
http://www.securityfocus.com/bid/38478	[email protected]	PatchThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1023674	[email protected]	Third Party AdvisoryVDB Entry
http://www.vmware.com/security/advisories/VMSA-2010-0014.html	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0517	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0605	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0626	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0637	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0667	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0682	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0686	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/0847	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/1107	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2010/2491	[email protected]	Third Party Advisory

see all 70 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-400	Uncontrolled Resource Consumption	[email protected]

Affected Products

Product	Versions
libpng libpng	>= 1.0.0, < 1.0.53 >= 1.2.0, < 1.2.43 >= 1.4.0, < 1.4.1
CPE cpe:2.3:a:libpng:libpng:::::::: Remediation No remediation found in references.
apple mac os x	< 10.6.5
CPE cpe:2.3:o:apple:mac_os_x:::::::: Remediation No remediation found in references.
fedoraproject fedora	11 12 13
CPE cpe:2.3:o:fedoraproject:fedora:11:::::::* cpe:2.3:o:fedoraproject:fedora:12:::::::* cpe:2.3:o:fedoraproject:fedora:13:::::::* Remediation No remediation found in references.
opensuse opensuse	11.0 11.1 11.2
CPE cpe:2.3:o:opensuse:opensuse:11.0:::::::* cpe:2.3:o:opensuse:opensuse:11.1:::::::* cpe:2.3:o:opensuse:opensuse:11.2:::::::* Remediation No remediation found in references.
suse linux enterprise server	9 10 sp3 11 - 11 sp1
CPE cpe:2.3:o:suse:linux_enterprise_server:9:::::::* cpe:2.3:o:suse:linux_enterprise_server:10:sp3:::::: cpe:2.3:o:suse:linux_enterprise_server:11:-:::::: cpe:2.3:o:suse:linux_enterprise_server:11:sp1:::::: Remediation No remediation found in references.
canonical ubuntu linux	6.06 8.04 8.10 9.04 9.10
CPE cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::* cpe:2.3:o:canonical:ubuntu_linux:8.04::::-::: cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::* cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::* Remediation No remediation found in references.
debian debian linux	5.0 6.0
CPE cpe:2.3:o:debian:debian_linux:5.0:::::::* cpe:2.3:o:debian:debian_linux:6.0:::::::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 29, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Aug 7, 2020	Modified Analysis	[email protected]
Aug 17, 2017	CVE Modified	[email protected]
Mar 4, 2010	Initial Analysis	[email protected]

CVE-2010-0205 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO