Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libpng | Libpng | * | 1.2.32 (excluding) |
| Libpng | Libpng | 1.4.0-beta1 (including) | 1.4.0-beta1 (including) |
| Libpng | Libpng | 1.4.0-beta10 (including) | 1.4.0-beta10 (including) |
| Libpng | Libpng | 1.4.0-beta11 (including) | 1.4.0-beta11 (including) |
| Libpng | Libpng | 1.4.0-beta12 (including) | 1.4.0-beta12 (including) |
| Libpng | Libpng | 1.4.0-beta13 (including) | 1.4.0-beta13 (including) |
| Libpng | Libpng | 1.4.0-beta14 (including) | 1.4.0-beta14 (including) |
| Libpng | Libpng | 1.4.0-beta15 (including) | 1.4.0-beta15 (including) |
| Libpng | Libpng | 1.4.0-beta16 (including) | 1.4.0-beta16 (including) |
| Libpng | Libpng | 1.4.0-beta17 (including) | 1.4.0-beta17 (including) |
| Libpng | Libpng | 1.4.0-beta18 (including) | 1.4.0-beta18 (including) |
| Libpng | Libpng | 1.4.0-beta19 (including) | 1.4.0-beta19 (including) |
| Libpng | Libpng | 1.4.0-beta2 (including) | 1.4.0-beta2 (including) |
| Libpng | Libpng | 1.4.0-beta20 (including) | 1.4.0-beta20 (including) |
| Libpng | Libpng | 1.4.0-beta21 (including) | 1.4.0-beta21 (including) |
| Libpng | Libpng | 1.4.0-beta22 (including) | 1.4.0-beta22 (including) |
| Libpng | Libpng | 1.4.0-beta23 (including) | 1.4.0-beta23 (including) |
| Libpng | Libpng | 1.4.0-beta24 (including) | 1.4.0-beta24 (including) |
| Libpng | Libpng | 1.4.0-beta25 (including) | 1.4.0-beta25 (including) |
| Libpng | Libpng | 1.4.0-beta26 (including) | 1.4.0-beta26 (including) |
| Libpng | Libpng | 1.4.0-beta27 (including) | 1.4.0-beta27 (including) |
| Libpng | Libpng | 1.4.0-beta28 (including) | 1.4.0-beta28 (including) |
| Libpng | Libpng | 1.4.0-beta29 (including) | 1.4.0-beta29 (including) |
| Libpng | Libpng | 1.4.0-beta3 (including) | 1.4.0-beta3 (including) |
| Libpng | Libpng | 1.4.0-beta30 (including) | 1.4.0-beta30 (including) |
| Libpng | Libpng | 1.4.0-beta31 (including) | 1.4.0-beta31 (including) |
| Libpng | Libpng | 1.4.0-beta32 (including) | 1.4.0-beta32 (including) |
| Libpng | Libpng | 1.4.0-beta33 (including) | 1.4.0-beta33 (including) |
| Libpng | Libpng | 1.4.0-beta4 (including) | 1.4.0-beta4 (including) |
| Libpng | Libpng | 1.4.0-beta5 (including) | 1.4.0-beta5 (including) |
| Libpng | Libpng | 1.4.0-beta6 (including) | 1.4.0-beta6 (including) |
| Libpng | Libpng | 1.4.0-beta7 (including) | 1.4.0-beta7 (including) |
| Libpng | Libpng | 1.4.0-beta8 (including) | 1.4.0-beta8 (including) |
| Libpng | Libpng | 1.4.0-beta9 (including) | 1.4.0-beta9 (including) |