CVE-2015-2158

High

Published: 06/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in versions before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.

Risk Assessment

The organization may be exposed to application crashes and the potential for remote code execution, which could lead to data loss or system compromise.

Recommendation

It is recommended to update pngcrush to version 1.7.84 or later to mitigate this vulnerability.

Other vulnerabilities in pngcrush

CVE-2015-7700Critical
A double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before version 1.7.87 allows attackers to have unspecified impact via unknown vectors.

Original NVD description (English source)

Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.