CVE-2004-0598
The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a...
The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
Exploit likelihood
What each source reports
NVD Score used
The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
- Record
CVE-2004-0598- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
- Record
CVE-2004-0598- Updated
- 2026-11-02
EUVDEUVD-2004-0597 No score
The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
- Record
EUVD-2004-0597- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7c4j-3c7c-wh66 No score
The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a...
The png_handle_iCCP function in libpng 1.2.5 and earlier allows remote attackers to cause a denial of service (application crash) via a certain PNG image that triggers a null dereference.
- Record
GHSA-7c4j-3c7c-wh66- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libpngDebian:3.0 |
before 1.0.12-3.woody.7 | 1.0.12-3.woody.7 |
libpng3Debian:3.0 |
before 1.2.1-1.1.woody.7 | 1.2.1-1.1.woody.7 |
libpngRed Hat:enterprise_linux:3::as |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-debuginfoRed Hat:enterprise_linux:3::as |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-develRed Hat:enterprise_linux:3::as |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng10Red Hat:enterprise_linux:3::as |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-debuginfoRed Hat:enterprise_linux:3::as |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-develRed Hat:enterprise_linux:3::as |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpngRed Hat:enterprise_linux:3::desktop |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-debuginfoRed Hat:enterprise_linux:3::desktop |
before 2:1.2.2-25 | 2:1.2.2-25 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libpng-develRed Hat:enterprise_linux:3::desktop |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng10Red Hat:enterprise_linux:3::desktop |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-develRed Hat:enterprise_linux:3::desktop |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpngRed Hat:enterprise_linux:3::es |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-debuginfoRed Hat:enterprise_linux:3::es |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-develRed Hat:enterprise_linux:3::es |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng10Red Hat:enterprise_linux:3::es |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-debuginfoRed Hat:enterprise_linux:3::es |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-develRed Hat:enterprise_linux:3::es |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpngRed Hat:enterprise_linux:3::ws |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-debuginfoRed Hat:enterprise_linux:3::ws |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-develRed Hat:enterprise_linux:3::ws |
before 2:1.2.2-25 | 2:1.2.2-25 |
libpng10Red Hat:enterprise_linux:3::ws |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-develRed Hat:enterprise_linux:3::ws |
before 0:1.0.13-15 | 0:1.0.13-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0598 is a medium vulnerability (CVSS 5.0) in Greg Roelofs Libpng, published August 4, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.15%, the 93rd percentile. Fixed in libpng 1.0.12-3.woody.7.
References
trustix.net/errata/2004/0040
sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1
mozilla.org/projects/security/known-vulnerabilities.html
redhat.com/support/errata/RHSA-2004-402.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10203
gentoo.org/security/en/glsa/glsa-200408-22.xml
Show 42 moreShow less
secunia.com/advisories/22958
bugzilla.fedora.us/show_bug.cgi?id=1943
marc.info?l=bugtraq&m=109761239318458&w=2
scary.beasts.org/security/CESA-2004-001.txt
debian.org/security/2004/dsa-536
lists.apple.com/mhonarc/security-announce/msg00056.html
mandriva.com/security/advisories?name=MDKSA-2006:213
us-cert.gov/cas/techalerts/TA04-217A.html
exchange.xforce.ibmcloud.com/vulnerabilities/16895
kb.cert.org/vuls/id/236656
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000856
securityfocus.com/bid/10857
novell.com/linux/security/advisories/2004_23_libpng.html
nvd.nist.gov/vuln/detail/CVE-2004-0598
github.com/advisories/GHSA-7c4j-3c7c-wh66
access.redhat.com/errata/RHSA-2004:402
bugzilla.redhat.com/show_bug.cgi?id=127869
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_402.json
cve.org/CVERecord?id=CVE-2002-1363