Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted GIF image that causes the realloc function to return a new pointer, which triggers memory corruption when the old pointer is accessed.

OptiPNG contained a bug in the GIF handling code that allowed to use already freed ressources. CVE-2009-0749 has been assigned to this issue.

Specially crafted BMP files could overflow a buffer in optipng (CVE-2008-5101), specially crafted GIF files could crash optipng (CVE-2009-0749).

The remote host is affected by the vulnerability described in GLSA-200903-12 (OptiPNG: User-assisted execution of arbitrary code)

    Roy Tam reported a use-after-free vulnerability in the     GIFReadNextExtension() function in lib/pngxtern/gif/gifread.c leading     to a memory corruption when reading a GIF image.
  Impact :

    A remote attacker could entice a user to process a specially crafted     GIF image, possibly resulting in the execution of arbitrary code with     the privileges of the user running the application, or a Denial of     Service.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
40292	openSUSE Security Update : optipng (optipng-972)	Nessus	SuSE Local Security Checks	high
40291	openSUSE Security Update : optipng (optipng-572)	Nessus	SuSE Local Security Checks	high
40097	openSUSE Security Update : optipng (optipng-972)	Nessus	SuSE Local Security Checks	high
40096	openSUSE Security Update : optipng (optipng-572)	Nessus	SuSE Local Security Checks	high
39361	openSUSE 10 Security Update : optipng (optipng-6290)	Nessus	SuSE Local Security Checks	high
35810	GLSA-200903-12 : OptiPNG: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
35784	openSUSE 10 Security Update : optipng (optipng-6038)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-0749

high

Tenable Plugins

high

high

high

high

high

high

high