CVE-2006-3334

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-06-30 · updated 2026-06-16

Description

Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to "chunk error processing," possibly involving the "chunk_name".

Affected products

Greg Roelofs Libpng: through 1.2.11; 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5 (+6)

References

http://docs.info.apple.com/article.html?artnum=307562
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
http://secunia.com/advisories/20960
http://secunia.com/advisories/22956
http://secunia.com/advisories/22957
http://secunia.com/advisories/22958
http://secunia.com/advisories/23335
http://secunia.com/advisories/29420
http://secunia.com/advisories/33137
http://security.gentoo.org/glsa/glsa-200607-06.xml
http://security.gentoo.org/glsa/glsa-200812-15.xml
http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=428123

Get alerted when CVE-2006-3334 or the next vulnerability affects your stack