CVE-2013-7354

MEDIUM

libpng <1.5.14rc03 - DoS

Title source: llm

Description

Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.

References (4)

[Mailing List] http://seclists.org/oss-sec/2014/q2/83

[Vendor Advisory] http://sourceforge.net/p/libpng/bugs/199/

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/67344

[Mailing List] http://lists.opensuse.org/opensuse-updates/2014-05/msg00015.html

Scores

CVSS v3 6.5

EPSS 0.0057

EPSS Percentile 68.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Classification

CWE

CWE-190 CWE-122 CWE-189

Status draft

Affected Products (24)

libpng/libpng < 1.5.13

libpng/libpng

... and 9 more

Timeline

Published May 06, 2014

Tracked Since Feb 18, 2026