CVE-2010-0205: Apple Mac OS X

Medium severity, CVSS 4.3. EPSS: 4.2% chance of exploitation in the next 30 days.

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before 1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly handle compressed ancillary-chunk data that has a disproportionately large uncompressed representation, which allows remote attackers to cause a denial of service (memory and CPU consumption, and application hang) via a crafted PNG file, as demonstrated by use of the deflate compression method on data composed of many occurrences of the same character, related to a "decompression bomb" attack.

Affected products

• Apple Mac OS X: before 10.6.5 (fixed in 10.6.5)
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only; version 9.10 only
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 11 only; version 12 only; version 13 only
• Libpng Libpng: from 1.0.0, before 1.0.53 (fixed in 1.0.53); from 1.2.0, before 1.2.43 (fixed in 1.2.43); from 1.4.0, before 1.4.1 (fixed in 1.4.1)
• Opensuse Opensuse: version 11.0 only; version 11.1 only; version 11.2 only
• Suse Linux Enterprise Server: version 9 only; version 10 only; version 11 only

Published 2010-03-03. Last modified 2026-06-16.