CVE-2008-3964 json
Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial o…
published 2008-09-10 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3949
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.3%
- EPSS 3.3% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.
Patch / fix
- libpng libpng 1.2.32
- libpng16 openSUSE Tumbleweed 1.6.37-3.3
opensuse advisories openSUSE-SU-2024:10972-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2008-3964 updated
libpng: off-by-one error in png_push_read_zTXt()
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.34% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- sourceforge.net http://sourceforge.net/tracker/index.php?func=detail&aid=2095669&group_id=5624&atid=105624 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-193 Off-by-one Error
References
-
sourceforge.net
/project/shownotes.php?release_id=624518
broken-link, patch
-
sourceforge.net
/tracker/index.php?func=detail&aid=2095669&group_id=5624&atid=105624
exploit, third-party-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-77-1020521.1-1
vendor-advisory, broken-link
-
sunsolve.sun.com
/search/document.do?assetkey=1-66-259989-1
vendor-advisory, broken-link
-
security.gentoo.org
/glsa/glsa-200812-15.xml
vendor-advisory, third-party-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2009:051
vendor-advisory, broken-link
-
sourceforge.net
/project/shownotes.php?group_id=5624&release_id=624517
product, third-party-advisory
-
openwall.com
/lists/oss-security/2008/09/09/3
mailing-list, third-party-advisory
-
secunia.com
/advisories/35386
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/44928
vdb-entry, third-party-advisory
-
vupen.com
/english/advisories/2009/1560
vdb-entry, permissions-required
-
vupen.com
/english/advisories/2009/1462
vdb-entry, permissions-required
-
securityfocus.com
/bid/31049
vdb-entry, third-party-advisory
-
secunia.com
/advisories/35302
third-party-advisory
-
openwall.com
/lists/oss-security/2008/09/09/8
mailing-list, third-party-advisory
-
kb.cert.org
/vuls/id/889484
third-party-advisory, us-government-resource
-
vupen.com
/english/advisories/2008/2512
vdb-entry, permissions-required
-
secunia.com
/advisories/31781
third-party-advisory
-
secunia.com
/advisories/33137
third-party-advisory
-
sourceforge.net
/mailarchive/forum.php?thread_name=e56ccc8f0809180317u6a5306fg14683947affb3e1b%40mail.gmail.com&forum_name=png
mailing-list, third-party-advisory
-
support.avaya.com
/elmodocs2/security/ASA-2009-208.htm
third-party-advisory
Sources
- CVE List CVE-2008-3964
- NVD CVE-2008-3964
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.