CVE-2008-1382
UnknownEPSS 5.51%
Last modified
CVE-2008-1382 is a vulnerability of currently unknown severity. libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.. EPSS estimates a 5.51% chance of exploitation in the next 30 days.
Description
libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Libpng | Libpng | 1.0.6 | A |
| Libpng | Libpng | 1.0.7 | Beta11 |
| Libpng | Libpng | 1.0.8 | Beta1 |
| Libpng | Libpng | 1.0.9 | Beta1 |
| Libpng | Libpng | 1.0.10 | Beta1 |
| Libpng | Libpng | 1.0.11 | Beta1 |
| Libpng | Libpng | 1.0.12 | — |
| Libpng | Libpng | 1.0.13 | — |
| Libpng | Libpng | 1.0.14 | — |
| Libpng | Libpng | 1.0.15 | — |
| Libpng | Libpng | 1.0.16 | — |
| Libpng | Libpng | 1.0.17 | — |
| Libpng | Libpng | 1.0.18 | — |
| Libpng | Libpng | 1.0.19 | — |
| Libpng | Libpng | 1.0.20 | — |
| Libpng | Libpng | 1.0.21 | — |
| Libpng | Libpng | 1.0.22 | — |
| Libpng | Libpng | 1.0.23 | — |
| Libpng | Libpng | 1.0.24 | — |
| Libpng | Libpng | 1.0.25 | — |
| Libpng | Libpng | 1.0.26 | — |
| Libpng | Libpng | 1.0.27 | — |
| Libpng | Libpng | 1.0.28 | — |
| Libpng | Libpng | 1.0.29 | — |
| Libpng | Libpng | 1.0.30 | — |
| Libpng | Libpng | 1.0.31 | — |
| Libpng | Libpng | 1.0.32 | — |
| Libpng | Libpng | 1.2.0 | Beta1 |
| Libpng | Libpng | 1.2.1 | Beta1 |
| Libpng | Libpng | 1.2.2 | Beta1 |
| Libpng | Libpng | 1.2.3 | Rc1 |
| Libpng | Libpng | 1.2.4 | Beta1 |
| Libpng | Libpng | 1.2.5 | Beta1 |
| Libpng | Libpng | 1.2.6 | Beta1 |
| Libpng | Libpng | 1.2.7 | Beta1 |
| Libpng | Libpng | 1.2.8 | Beta1 |
| Libpng | Libpng | 1.2.9 | Beta1 |
| Libpng | Libpng | 1.2.10 | Beta1 |
| Libpng | Libpng | 1.2.11 | Beta1 |
| Libpng | Libpng | 1.2.13 | Beta1 |
| Libpng | Libpng | 1.2.14 | Beta1 |
| Libpng | Libpng | 1.2.15 | Beta1 |
| Libpng | Libpng | 1.2.16 | Beta1 |
| Libpng | Libpng | 1.2.17 | Beta1 |
| Libpng | Libpng | 1.2.19 | Beta1 |
| Libpng | Libpng | 1.2.20 | Beta01 |
| Libpng | Libpng | 1.2.21 | Rc3 |
| Libpng | Libpng | 1.2.22 | Beta1 |
| Libpng | Libpng | 1.2.23 | Beta01 |
| Libpng | Libpng | 1.2.24 | Beta01 |
Showing 50 of 53 affected configurations. See NVD for the full list.
References
- http://secunia.com/advisories/29792Vendor Advisory
- http://www.us-cert.gov/cas/techalerts/TA08-260A.htmlUS Government Resource
- http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
- http://secunia.com/advisories/29792Vendor Advisory
- http://www.us-cert.gov/cas/techalerts/TA08-260A.htmlUS Government Resource
- http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlUS Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2008-1382?
libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.
How severe is CVE-2008-1382?
Severity scoring for CVE-2008-1382 is pending analysis. The EPSS model estimates a 5.51% probability of exploitation in the next 30 days.
How do I fix CVE-2008-1382?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2008
- CVE-2008-1376A certain Red Hat build script for nfs-utils before 1.0.9-35…
- CVE-2008-1377The (1) SProcRecordCreateContext and (2) SProcRecordRegister…
- CVE-2008-1378Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2008-1379Integer overflow in the fbShmPutImage function in the MIT-SH…
- CVE-2008-1380The JavaScript engine in Mozilla Firefox before 2.0.0.14, Th…
- CVE-2008-1381ZoneMinder before 1.23.3 allows remote authenticated users, …
- CVE-2008-1383The docert function in ssl-cert.eclass, when used by src_com…
- CVE-2008-1384Integer overflow in PHP 5.2.5 and earlier allows context-dep…
- CVE-2008-1385Cross-site scripting (XSS) vulnerability in the Top Referrer…
- CVE-2008-1386Multiple cross-site scripting (XSS) vulnerabilities in the i…
- CVE-2008-1387ClamAV before 0.93 allows remote attackers to cause a denial…
- CVE-2008-1389libclamav/chmunpack.c in the chm-parser in ClamAV before 0.9…
Are you affected by CVE-2008-1382?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST