Log in Start free

Vulnerability · Published Dec 8, 2020 · Assigned by redhat

CVE-2020-27818

Low 3.3

In plain English

A low-severity buffer overflow in pngcheck. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)3.3Low
Exploit odds (30 days)1.2%top 31.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temporary denial of service, posing a low risk to application availability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12pngcheck2.3.0-13DEBIAN-CVE-2020-27818
Debian:13pngcheck2.3.0-13DEBIAN-CVE-2020-27818
Debian:14pngcheck2.3.0-13DEBIAN-CVE-2020-27818
Ubuntu:24.04:LTSpngcheckno fix listedUBUNTU-CVE-2020-27818
Ubuntu:25.10pngcheckno fix listedUBUNTU-CVE-2020-27818
Ubuntu:26.04:LTSpngcheckno fix listedUBUNTU-CVE-2020-27818
Ubuntu:26.10pngcheckno fix listedUBUNTU-CVE-2020-27818

Affected products (as reported)

VendorProductVersions
n/a pngcheck pngcheck-2.4.0

Weakness: CWE-120

References