Optipng
Vendor:
First CVE: Nov 17, 2008 · Active for 17 years
11
Total CVEs
More Total CVEs than 87% of tracked products
1.8
Avg CVEs / Year
Higher CVE frequency than 63% of tracked products
7.8
Avg CVSS
Higher Avg CVSS than 66% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Optipng over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 17, 2008
17 years ago
Most Recent CVE
Oct 1, 2023
1,031 days ago
CVE Severity & Scoring
Optipng11 CVEs
18%
82%
All CVEs353,173 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local6 (54.5%)
Network3 (27.3%)
Unknown2 (18.2%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low9 (81.8%)
High0 (0.0%)
Unknown2 (18.2%)
User Interaction
None0 (0.0%)
Unknown2 (18.2%)
Required9 (81.8%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None9 (81.8%)
Unknown2 (18.2%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-7801HIGH Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file. | Apr 20, 2016 | 8.8 | 29 | NO | NO |
CVE-2017-16938HIGH A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact with a maliciously crafted GIF format file, relate | Nov 24, 2017 | 7.8 | 25 | NO | NO |
CVE-2016-3982HIGH Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and c | Apr 13, 2016 | 8.8 | 25 | NO | NO |
CVE-2012-4432HIGH Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette | Oct 1, 2012 | 7.5 | 25 | NO | NO |
CVE-2016-2191MEDIUM The bmp_read_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid memory write and crash) via a series of delt | Apr 13, 2016 | 6.5 | 24 | NO | NO |
CVE-2008-5101HIGH Buffer overflow in the BMP reader in OptiPNG 0.6 and 0.6.1 allows user-assisted attackers to execute arbitrary code via a crafted BMP image, related to an "array overflow." | Nov 17, 2008 | 9.3 | 24 | NO | NO |
CVE-2023-43907HIGH OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c. | Oct 1, 2023 | 7.8 | 22 | NO | NO |
CVE-2017-1000229HIGH Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of service. | Nov 17, 2017 | 7.8 | 22 | NO | NO |
CVE-2016-3981HIGH Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write acc | Apr 13, 2016 | 7.8 | 21 | NO | NO |
CVE-2009-0749HIGH Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of | Mar 2, 2009 | 7.8 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Optipng
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| hg | 1 | 7.5 | 5.2% | 0 | 0 |
| 0.7.7 | 1 | 7.8 | 0.5% | 0 | 0 |
| 0.7.6 | 2 | 7.8 | 1.9% | 0 | 0 |
| 0.7.5 | 1 | 5.5 | 1.6% | 0 | 0 |
| 0.7.2 | 2 | 7.0 | 4.4% | 0 | 0 |
| 0.7.1 | 1 | 7.5 | 5.2% | 0 | 0 |
| 0.7.0 | 1 | 7.5 | 5.2% | 0 | 0 |
| 0.6.1 | 1 | 9.3 | 4.0% | 0 | 0 |
| 0.6 | 1 | 9.3 | 4.0% | 0 | 0 |