CVE-2010-2249: Apple iPhone OS

Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days.

Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks.

Affected products

• Apple iPhone OS: from 2.0, up to and including 4.1
• Apple iTunes: before 10.2 (fixed in 10.2)
• Apple Safari: before 5.0.4 (fixed in 5.0.4)
• Apple tvOS: before 4.1.0 (fixed in 4.1.0)
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 9.04 only; version 9.10 only; version 10.04 only
• Debian Debian Linux: version 5.0 only
• Fedoraproject Fedora: version 12 only; version 13 only
• Libpng Libpng: before 1.2.44 (fixed in 1.2.44); from 1.4.0, before 1.4.3 (fixed in 1.4.3)
• Opensuse Opensuse: version 11.1 only; version 11.2 only
• Suse Linux Enterprise Server: version 9 only; version 10 only; version 11 only
• VMware Player: from 2.5, before 2.5.5 (fixed in 2.5.5); from 3.1, before 3.1.2 (fixed in 3.1.2)
• VMware Workstation: from 6.5.0, before 6.5.5 (fixed in 6.5.5); from 7.1, before 7.1.2 (fixed in 7.1.2)

Published 2010-06-30. Last modified 2026-06-16.