CVE-2008-3964

Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.

• CWE-193

• http://secunia.com/advisories/31781Third Party Advisory
• http://secunia.com/advisories/33137Third Party Advisory
• http://secunia.com/advisories/35302Third Party Advisory
• http://secunia.com/advisories/35386Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200812-15.xmlThird Party Advisory
• http://sourceforge.net/mailarchive/forum.php?thread_name=e56ccc8f0809180317u6a5306fg14683947affb3e1b%40mail.gmail.com&forum_name=png-mng-implementThird Party Advisory
• http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=624517Product, Third Party Advisory
• http://sourceforge.net/project/shownotes.php?release_id=624518Broken Link, Patch
• http://sourceforge.net/tracker/index.php?func=detail&aid=2095669&group_id=5624&atid=105624Exploit, Third Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1Broken Link
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1Broken Link
• http://support.avaya.com/elmodocs2/security/ASA-2009-208.htmThird Party Advisory
• http://www.kb.cert.org/vuls/id/889484Third Party Advisory, US Government Resource
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:051Broken Link
• http://www.openwall.com/lists/oss-security/2008/09/09/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2008/09/09/8Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/31049Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2008/2512Permissions Required
• http://www.vupen.com/english/advisories/2009/1462Permissions Required
• http://www.vupen.com/english/advisories/2009/1560Permissions Required
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44928Third Party Advisory, VDB Entry
• http://secunia.com/advisories/31781Third Party Advisory
• http://secunia.com/advisories/33137Third Party Advisory
• http://secunia.com/advisories/35302Third Party Advisory
• http://secunia.com/advisories/35386Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200812-15.xmlThird Party Advisory
• http://sourceforge.net/mailarchive/forum.php?thread_name=e56ccc8f0809180317u6a5306fg14683947affb3e1b%40mail.gmail.com&forum_name=png-mng-implementThird Party Advisory
• http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=624517Product, Third Party Advisory
• http://sourceforge.net/project/shownotes.php?release_id=624518Broken Link, Patch
• http://sourceforge.net/tracker/index.php?func=detail&aid=2095669&group_id=5624&atid=105624Exploit, Third Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1Broken Link
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1Broken Link
• http://support.avaya.com/elmodocs2/security/ASA-2009-208.htmThird Party Advisory
• http://www.kb.cert.org/vuls/id/889484Third Party Advisory, US Government Resource
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:051Broken Link
• http://www.openwall.com/lists/oss-security/2008/09/09/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2008/09/09/8Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/31049Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2008/2512Permissions Required
• http://www.vupen.com/english/advisories/2009/1462Permissions Required
• http://www.vupen.com/english/advisories/2009/1560Permissions Required
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44928Third Party Advisory, VDB Entry

Published

Sep 11, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3958IBM DB2 UDB 8 before Fixpak 17 allows remote attackers to ca…
• CVE-2008-3959IBM DB2 UDB 8.1 before FixPak 16, 8.2 before FixPak 9, and 9…
• CVE-2008-3960Unspecified vulnerability in the JDBC Applet Server Service …
• CVE-2008-3961Multiple unspecified vulnerabilities in Adobe Illustrator CS…
• CVE-2008-3962The from_format function in ssmtp.c in ssmtp 2.61 and 2.62, …
• CVE-2008-3963MySQL 5.0 before 5.0.66, 5.1 before 5.1.26, and 6.0 before 6…
• CVE-2008-3965SQL injection vulnerability in misc.php in MyBB (aka MyBulle…
• CVE-2008-3966Multiple cross-site scripting (XSS) vulnerabilities in MyBB …
• CVE-2008-3967moderation.php in MyBB (aka MyBulletinBoard) before 1.4.1 do…
• CVE-2008-3968Cross-site scripting (XSS) vulnerability in userlist.php in …
• CVE-2008-3969Multiple unspecified vulnerabilities in BitlBee before 1.2.3…
• CVE-2008-3970pam_mount 0.10 through 0.45, when luserconf is enabled, does…