Skip to content
OpenAdvisories
Unscored Public exploit CVE-2020-27818 EUVD-2020-20319GHSA-xjm9-9gr6-gcpx

A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngchec…

Published Dec 8, 2020 · Updated Aug 4, 2024 · Assigned by redhat

Package: pngcheck Package: pngcheck Ecosystem: Debian Ecosystem: Ubuntu

Description

A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be processed by pngcheck could cause a temporary denial of service, posing a low risk to application availability.

Affected products

VendorProductAffectedFixed
— pngcheck pngcheck-2.4.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 pngcheck 2.3.0-13 —
Debian 13 pngcheck 2.3.0-13 —
Debian 12 pngcheck 2.3.0-13 —
Debian 9 pngcheck 2.3.0-7+deb9u1 DLA-3032-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pngcheck No fix yet —
Ubuntu 26.04 LTS pngcheck No fix yet —
Ubuntu 25.10 pngcheck No fix yet —
Ubuntu 24.04 LTS pngcheck No fix yet —
Ubuntu 20.04 LTS pngcheck 2.3.0-7ubuntu0.20.04.1 USN-6182-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS pngcheck 2.3.0-7ubuntu0.18.04.1~esm1 USN-6182-1
Ubuntu Pro 16.04 LTS pngcheck 2.3.0-7ubuntu0.16.04.1~esm1 USN-6182-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP2 pngcheck 2.3.0-bp152.4.3.1 openSUSE-SU-2020:2220-1
SUSE Package Hub 15 SP1 pngcheck 2.3.0-bp151.4.3.1 openSUSE-SU-2020:2227-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed pngcheck 3.0.0-1.7 openSUSE-SU-2024:11176-1
openSUSE Leap 15.2 pngcheck 2.3.0-lp152.4.3.1 openSUSE-SU-2020:2177-1
openSUSE Leap 15.1 pngcheck 2.3.0-lp151.3.3.1 openSUSE-SU-2020:2198-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • 13m0n4de/pngcheck-vulns ★ 0 · Jan 19, 2025

    A repository of proof-of-concept files demonstrating disclosed and patched vulnerabilities in pngcheck (2.4.0 - 3.0.1), including CVE-2020-27818, CVE-2020-35511 and other vulns.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 7

References