CVE-2017-1000229
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to...
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- Record
CVE-2017-1000229- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- Record
CVE-2017-1000229- Updated
- 2026-11-02
EUVDEUVD-2017-1497 No score
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- Record
EUVD-2017-1497- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jv9j-wgx3-2884
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to...
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- Record
GHSA-jv9j-wgx3-2884- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- Record
CVE-2017-1000229- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-1000229
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- Record
DEBIAN-CVE-2017-1000229- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2017-1000229
Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service.
- Record
UBUNTU-CVE-2017-1000229- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0447 No score
Updated optipng packages fix security vulnerability
- CVE-2017-1000229: Fix integer overflow bug in function minitiff_read_info() allows an attacker to remotely execute code or cause denial of service.
- CVE-2017-16938: Fix a global buffer overflow that allows attackers to cause DoS via a maliciously crafted GIF file.
- Record
MGASA-2017-0447- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11131-1 No score
optipng-0.7.7-2.3 on GA media
These are all security issues fixed in the optipng-0.7.7-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11131-1- Updated
- 2026-11-02
OSVUSN-3495-1 No score
optipng vulnerability
It was discovered that OptiPNG incorrectly handled memory. A remote attacker could use this issue with a specially crafted image file to cause OptiPNG to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3495-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
optipngDebian:12 |
before 0.7.6-1.1 | 0.7.6-1.1 |
optipngDebian:13 |
before 0.7.6-1.1 | 0.7.6-1.1 |
optipngDebian:14 |
before 0.7.6-1.1 | 0.7.6-1.1 |
optipngDebian:7 |
before 0.6.4-1+deb7u3, plus listed versions 0.6.4-10.6.4-1+deb7u10.6.4-1+deb7u2 |
0.6.4-1+deb7u3 |
optipngDebian:8 From an advisory covering 2 CVEs |
before 0.7.5-1+deb8u2, plus listed versions 0.7.5-10.7.5-1+deb8u1 |
0.7.5-1+deb8u2 |
optipngDebian:9 From an advisory covering 2 CVEs |
before 0.7.6-1+deb9u1, plus listed versions 0.7.6-1 |
0.7.6-1+deb9u1 |
optipngMageia:5 From an advisory covering 2 CVEs |
before 0.7.6-1.1.mga5 | 0.7.6-1.1.mga5 |
optipngMageia:6 From an advisory covering 2 CVEs |
before 0.7.6-1.1.mga6 | 0.7.6-1.1.mga6 |
optipngUbuntu:14.04:LTS |
before 0.6.4-1ubuntu0.14.04.2, plus listed versions 0.6.4-1build10.6.4-1ubuntu0.14.04.1 |
0.6.4-1ubuntu0.14.04.2 |
optipngUbuntu:16.04:LTS |
before 0.7.6-1ubuntu0.16.04.1, plus listed versions 0.7.5-10.7.6-1 |
0.7.6-1ubuntu0.16.04.1 |
optipngopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 0.7.7-2.3 | 0.7.7-2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1000229 is a high vulnerability (CVSS 7.8) in Optipng Project Optipng, published November 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile. Fixed in optipng 0.7.6-1.1.
References
lists.debian.org/debian-lts-announce/2017/11/msg00030.html
debian.org/security/2017/dsa-4058
security.gentoo.org/glsa/201801-02
sourceforge.net/p/optipng/bugs/65
nvd.nist.gov/vuln/detail/CVE-2017-1000229
github.com/advisories/GHSA-jv9j-wgx3-2884
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2017-1000229
advisories.mageia.org/MGASA-2017-0447.html
bugs.mageia.org/show_bug.cgi?id=22099
ubuntu.com/security/CVE-2017-1000229
cve.org/CVERecord?id=CVE-2017-1000229
suse.com/security/cve/CVE-2008-5101