The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libpng | Libpng | 1.0.5g | 1.0.5g |
| Libpng | Libpng | 1.0.37 | 1.0.37 |
| Libpng | Libpng | 0.99e | 0.99e |
| Libpng | Libpng | 0.98 | 0.98 |
| Libpng | Libpng | 1.0.4d | 1.0.4d |
| Libpng | Libpng | 1.0.41 | 1.0.41 |
| Libpng | Libpng | 1.0.0b | 1.0.0b |
| Libpng | Libpng | 1.0.1b | 1.0.1b |
| Libpng | Libpng | 1.0.46 | 1.0.46 |
| Libpng | Libpng | 0.99d | 0.99d |
| Libpng | Libpng | 1.0.4c | 1.0.4c |
| Libpng | Libpng | 1.0.65 | 1.0.65 |
| Libpng | Libpng | 1.0.5t | 1.0.5t |
| Libpng | Libpng | 1.0.1 | 1.0.1 |
| Libpng | Libpng | 1.0.4e | 1.0.4e |
| Libpng | Libpng | 1.0.1c | 1.0.1c |
| Libpng | Libpng | 1.0.8 | 1.0.8 |
| Libpng | Libpng | 0.81 | 0.81 |
| Libpng | Libpng | 1.0.5n | 1.0.5n |
| Libpng | Libpng | 0.88 | 0.88 |
| Libpng | Libpng | 1.0.6f | 1.0.6f |
| Libpng | Libpng | 1.0.5k | 1.0.5k |
| Libpng | Libpng | 1.0.14 | 1.0.14 |
| Libpng | Libpng | 0.8 | 0.8 |
| Libpng | Libpng | 1.0.5q | 1.0.5q |
| Libpng | Libpng | 0.99f | 0.99f |
| Libpng | Libpng | 1.0.17 | 1.0.17 |
| Libpng | Libpng | 1.0.35 | 1.0.35 |
| Libpng | Libpng | 0.85 | 0.85 |
| Libpng | Libpng | 1.0.4 | 1.0.4 |
| Libpng | Libpng | 1.0.52 | 1.0.52 |
| Libpng | Libpng | 0.95 | 0.95 |
| Libpng | Libpng | 1.0.27 | 1.0.27 |
| Libpng | Libpng | 1.0.22 | 1.0.22 |
| Libpng | Libpng | 0.89c | 0.89c |
| Libpng | Libpng | 1.0.11 | 1.0.11 |
| Libpng | Libpng | 1.0.20 | 1.0.20 |
| Libpng | Libpng | 1.0.55 | 1.0.55 |
| Libpng | Libpng | 1.0.9 | 1.0.9 |
| Libpng | Libpng | 1.0.13 | 1.0.13 |
| Libpng | Libpng | 0.86 | 0.86 |
| Libpng | Libpng | 1.0.44 | 1.0.44 |
| Libpng | Libpng | 1.0.5c | 1.0.5c |
| Libpng | Libpng | 1.0.6 | 1.0.6 |
| Libpng | Libpng | 1.0.5d | 1.0.5d |
| Libpng | Libpng | 1.0.32 | 1.0.32 |
| Libpng | Libpng | 0.90 | 0.90 |
| Libpng | Libpng | 1.0.50 | 1.0.50 |
| Libpng | Libpng | 1.0.0a | 1.0.0a |
| Libpng | Libpng | 1.0.5a | 1.0.5a |
| Libpng | Libpng | 1.0.5p | 1.0.5p |
| Libpng | Libpng | 1.0.34 | 1.0.34 |
| Libpng | Libpng | 0.99a | 0.99a |
| Libpng | Libpng | 1.0.25 | 1.0.25 |
| Libpng | Libpng | 1.0.21 | 1.0.21 |
| Libpng | Libpng | 1.0.5f | 1.0.5f |
| Libpng | Libpng | 1.0.5i | 1.0.5i |
| Libpng | Libpng | 1.0.43 | 1.0.43 |
| Libpng | Libpng | 1.0.38 | 1.0.38 |
| Libpng | Libpng | 1.0.3 | 1.0.3 |
| Libpng | Libpng | 1.0.40 | 1.0.40 |
| Libpng | Libpng | 1.0.51 | 1.0.51 |
| Libpng | Libpng | 1.0.4f | 1.0.4f |
| Libpng | Libpng | 1.0.18 | 1.0.18 |
| Libpng | Libpng | 1.0.6i | 1.0.6i |
| Libpng | Libpng | 1.0.5v | 1.0.5v |
| Libpng | Libpng | 1.0.1e | 1.0.1e |
| Libpng | Libpng | 1.0.4b | 1.0.4b |
| Libpng | Libpng | 1.0.5l | 1.0.5l |
| Libpng | Libpng | 1.0.64 | 1.0.64 |
| Libpng | Libpng | 1.0.54 | 1.0.54 |
| Libpng | Libpng | 1.0.7 | 1.0.7 |
| Libpng | Libpng | 1.0.6h | 1.0.6h |
| Libpng | Libpng | 1.0.5s | 1.0.5s |
| Libpng | Libpng | 1.0.16 | 1.0.16 |
| Libpng | Libpng | 1.0.59 | 1.0.59 |
| Libpng | Libpng | 1.0.2 | 1.0.2 |
| Libpng | Libpng | 1.0.2a | 1.0.2a |
| Libpng | Libpng | 1.0.5 | 1.0.5 |
| Libpng | Libpng | 1.0.3b | 1.0.3b |
| Libpng | Libpng | 1.0.29 | 1.0.29 |
| Libpng | Libpng | 1.0.56 | 1.0.56 |
| Libpng | Libpng | 1.0.39 | 1.0.39 |
| Libpng | Libpng | 1.0.42 | 1.0.42 |
| Libpng | Libpng | 1.0.24 | 1.0.24 |
| Libpng | Libpng | 1.0.61 | 1.0.61 |
| Libpng | Libpng | 0.99c | 0.99c |
| Libpng | Libpng | 0.99h | 0.99h |
| Libpng | Libpng | 1.0.5r | 1.0.5r |
| Libpng | Libpng | 1.0.5b | 1.0.5b |
| Libpng | Libpng | 1.0.12 | 1.0.12 |
| Libpng | Libpng | 1.0.15 | 1.0.15 |
| Libpng | Libpng | 1.0.6e | 1.0.6e |
| Libpng | Libpng | 1.0.19 | 1.0.19 |
| Libpng | Libpng | 1.0.57 | 1.0.57 |
| Libpng | Libpng | 1.0.62 | 1.0.62 |
| Libpng | Libpng | 1.0.5m | 1.0.5m |
| Libpng | Libpng | 0.99g | 0.99g |
| Libpng | Libpng | 0.87 | 0.87 |
| Libpng | Libpng | 1.0.28 | 1.0.28 |
| Libpng | Libpng | 1.0.47 | 1.0.47 |
| Libpng | Libpng | 1.0.6g | 1.0.6g |
| Libpng | Libpng | 1.0.48 | 1.0.48 |
| Libpng | Libpng | 1.0.66 | 1.0.66 |
| Libpng | Libpng | 1.0.3a | 1.0.3a |
| Libpng | Libpng | 0.97 | 0.97 |
| Libpng | Libpng | 1.0.45 | 1.0.45 |
| Libpng | Libpng | 1.0.5j | 1.0.5j |
| Libpng | Libpng | 1.0.26 | 1.0.26 |
| Libpng | Libpng | 1.0.1a | 1.0.1a |
| Libpng | Libpng | 1.0.1d | 1.0.1d |
| Libpng | Libpng | 1.0.60 | 1.0.60 |
| Libpng | Libpng | 1.0.5h | 1.0.5h |
| Libpng | Libpng | 1.0.6j | 1.0.6j |
| Libpng | Libpng | 0.89 | 0.89 |
| Libpng | Libpng | 1.0.33 | 1.0.33 |
| Libpng | Libpng | 1.0.0 | 1.0.0 |
| Libpng | Libpng | 1.0.3d | 1.0.3d |
| Libpng | Libpng | 1.0.4a | 1.0.4a |
| Libpng | Libpng | 1.0.5o | 1.0.5o |
| Libpng | Libpng | 1.0.53 | 1.0.53 |
| Libpng | Libpng | 1.0.23 | 1.0.23 |
| Libpng | Libpng | 1.0.63 | 1.0.63 |
| Libpng | Libpng | 0.82 | 0.82 |
| Libpng | Libpng | 1.00 | 1.00 |
| Libpng | Libpng | 1.0.30 | 1.0.30 |
| Libpng | Libpng | 1.0.5u | 1.0.5u |
| Libpng | Libpng | 1.0.10 | 1.0.10 |
| Libpng | Libpng | 1.0.31 | 1.0.31 |
| Libpng | Libpng | 0.71 | 0.71 |
| Libpng | Libpng | 0.99 | 0.99 |
| Libpng | Libpng | 1.0.58 | 1.0.58 |
| Libpng | Libpng | 1.0.6d | 1.0.6d |
| Libpng | Libpng | 0.99b | 0.99b |
| Libpng | Libpng | 0.96 | 0.96 |
| Libpng | Libpng | 1.0.5e | 1.0.5e |