Strix
26.1K

CVE-2014-9495

HIGHCVSS 8.8/10EPSS 3.89%

Last modified

CVE-2014-9495 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.. EPSS estimates a 3.89% chance of exploitation in the next 30 days.

Description

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
3.89%

88.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
AppleMac Os X<= 10.11.3—
LibpngLibpng<= 1.5.20Beta
LibpngLibpng1.6.0—
LibpngLibpng1.6.1—
LibpngLibpng1.6.2—
LibpngLibpng1.6.3—
LibpngLibpng1.6.4—
LibpngLibpng1.6.5—
LibpngLibpng1.6.6—
LibpngLibpng1.6.7—
LibpngLibpng1.6.8—
LibpngLibpng1.6.9—
LibpngLibpng1.6.10—
LibpngLibpng1.6.11—
LibpngLibpng1.6.12Beta
LibpngLibpng1.6.13—
LibpngLibpng1.6.14—
LibpngLibpng1.6.15—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2014-9495?
Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.
How severe is CVE-2014-9495?
CVE-2014-9495 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 3.89% probability of exploitation in the next 30 days.
How do I fix CVE-2014-9495?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-9495?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST