CVE-2004-0597
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote...
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Exploit likelihood
What each source reports
NVD Score used
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
- Record
CVE-2004-0597- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
- Record
CVE-2004-0597- Updated
- 2026-11-02
EUVDEUVD-2004-0596No score
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
- Record
EUVD-2004-0596- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pjf2-ggxp-rg8pNo score
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote...
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
- Record
GHSA-pjf2-ggxp-rg8p- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libpngDebian:3.0 From an advisory covering 4 CVEs | before 1.0.12-3.woody.7 | 1.0.12-3.woody.7 |
libpng3Debian:3.0 From an advisory covering 4 CVEs | before 1.2.1-1.1.woody.7 | 1.2.1-1.1.woody.7 |
libpngRed Hat:enterprise_linux:3::as From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-develRed Hat:enterprise_linux:3::as From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng10Red Hat:enterprise_linux:3::as From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-develRed Hat:enterprise_linux:3::as From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpngRed Hat:enterprise_linux:3::desktop From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libpng-develRed Hat:enterprise_linux:3::desktop From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng10Red Hat:enterprise_linux:3::desktop From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-develRed Hat:enterprise_linux:3::desktop From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpngRed Hat:enterprise_linux:3::es From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-develRed Hat:enterprise_linux:3::es From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng10Red Hat:enterprise_linux:3::es From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-develRed Hat:enterprise_linux:3::es From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpngRed Hat:enterprise_linux:3::ws From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng-develRed Hat:enterprise_linux:3::ws From an advisory covering 4 CVEs | before 2:1.2.2-25 | 2:1.2.2-25 |
libpng10Red Hat:enterprise_linux:3::ws From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
libpng10-develRed Hat:enterprise_linux:3::ws From an advisory covering 4 CVEs | before 0:1.0.13-15 | 0:1.0.13-15 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | LibPNG Graphics Library - Remote Buffer Overflow | 2004-08-11 |
| Exploit-DB | LibPNG 1.2.5 - 'png_jmpbuf()' Local Buffer Overflow | 2004-08-13 |
| Exploit-DB | Microsoft MSN Messenger 6.2.0137 - '.png' Remote Buffer Overflow | 2005-02-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0597 is a high vulnerability (CVSS 10.0) in Greg Roelofs Libpng, published August 4, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 81.9%, the 99th percentile. No source names a fixed version.
References
trustix.net/errata/2004/0040
sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2274
mozilla.org/projects/security/known-vulnerabilities.html
redhat.com/support/errata/RHSA-2004-421.html
Show 56 moreShow less
gentoo.org/security/en/glsa/glsa-200408-22.xml
secunia.com/advisories/22958
marc.info?l=bugtraq&m=109900315219363&w=2
bugzilla.fedora.us/show_bug.cgi?id=1943
us-cert.gov/cas/techalerts/TA05-039A.html
exchange.xforce.ibmcloud.com/vulnerabilities/16894
scary.beasts.org/security/CESA-2004-001.txt
securityfocus.com/bid/15495
debian.org/security/2004/dsa-536
kb.cert.org/vuls/id/388984
lists.apple.com/mhonarc/security-announce/msg00056.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-009
mandriva.com/security/advisories?name=MDKSA-2006:213
adobe.com/support/downloads/detail.jsp?ftpID=2679
coresecurity.com/common/showdoc.php?idx=421&idxseccion=10
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000856
novell.com/linux/security/advisories/2004_23_libpng.html
nvd.nist.gov/vuln/detail/CVE-2004-0597
github.com/advisories/GHSA-pjf2-ggxp-rg8p
access.redhat.com/errata/RHSA-2004:402
bugzilla.redhat.com/show_bug.cgi?id=127869
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_402.json
cve.org/CVERecord?id=CVE-2002-1363