{"id":"CVE-2015-2158","aliases":["AZL-43813","AZL-43846","AZL-43966","AZL-44008","AZL-44265","AZL-44589","AZL-44832","AZL-44913","EUVD-2015-2267","GHSA-qm7x-p4cx-r7pj","MGASA-2015-0101"],"status":"published","title":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84...","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02884,"percentile":0.86956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2015-03-10T16:48:25Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Azure Linux:3","package":"fltk","fixed_in":["1.3.8-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"teckit","fixed_in":["2.5.12-4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"pngcrush","fixed_in":["1.7.84-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.1-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"fltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.5-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"teckit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.9-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"clucene","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.3.4-38"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.1-12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"clucene","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.3.4-40"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"teckit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.12-4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"pngcrush","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.84-1.mga4"}]}]}],"products":[{"vendor":"pngcrush_project","product":"pngcrush"}],"references":[{"url":"https://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/72830","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2015/03/01/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1198171","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2158","tags":["web"]},{"url":"https://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released"},{"url":"https://github.com/advisories/GHSA-qm7x-p4cx-r7pj"},{"url":"https://advisories.mageia.org/MGASA-2015-0101.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15393","tags":["report"]},{"url":"http://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released/","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2015/03/01/1","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-2158","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:00:00Z","modified":"2024-08-06T05:10:14.433Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2015-2267","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:00:00Z","modified":"2024-08-06T05:10:14Z","updated_at":"2026-11-03T02:22:12.830256Z"}],"ghsa":[{"id":"GHSA-qm7x-p4cx-r7pj","title":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84...","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2022-05-17T00:29:02Z","modified":"2025-04-20T03:47:30Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:53.867735Z"}],"nvd":[{"id":"CVE-2015-2158","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00.373Z","modified":"2026-06-17T00:23:41.67Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:03:19.244941Z"}],"osv":[{"id":"AZL-43813","title":"CVE-2015-2158 affecting package openjpeg2 2.3.1-12","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00Z","modified":"2026-04-21T04:31:09.640622Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-43846","title":"CVE-2015-2158 affecting package fltk 1.3.5-4","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00Z","modified":"2026-04-21T04:31:10.622893Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-43966","title":"CVE-2015-2158 affecting package teckit 2.5.9-4","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00Z","modified":"2026-04-21T04:31:13.900119Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44008","title":"CVE-2015-2158 affecting package clucene 2.3.3.4-38","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00Z","modified":"2026-04-21T04:31:15.000619Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44265","title":"CVE-2015-2158 affecting package fltk for versions less than 1.3.8-1","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00Z","modified":"2026-04-21T04:57:01.983614Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44589","title":"CVE-2015-2158 affecting package openjpeg2 2.3.1-12","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"AZL-44832","title":"CVE-2015-2158 affecting package clucene 2.3.3.4-40","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"AZL-44913","title":"CVE-2015-2158 affecting package teckit for versions less than 2.5.12-4","description":"Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file.","status":"published","published":"2017-10-06T15:29:00Z","modified":"2026-04-21T04:56:05.462385Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"MGASA-2015-0101","title":"Updated pngcrush package fixes security vulnerability","description":"pngcrush-1.7.84 fixes defects reported by Coverity-scan, so it should be more\nresistant to crashes due to malformed input files, such as the one presented\nin CVE-2015-2158.\n","status":"published","published":"2015-03-10T16:48:25Z","modified":"2026-04-16T06:24:37.668606321Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}