CVE catalog

CVE-2009-0040

MozillaFirefox-50.1.0-1.1 on GA media

Severity: Unknown
Published: Mar 4, 2009, 7:58:00 PM UTC
Updated: Mar 9, 2026, 1:01:19 AM UTC
Source: [NVD] · [CVE record]
EPSS: 4.83% · Oct 25, 2026

The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libpng	4.0	`1.2.15~beta5-1`	vulnerable
Debian	libpng	4.0	`1.2.15~beta5-1+etch2`	fixed
Debian	libpng	5.0	`1.2.27-2`	vulnerable
Debian	libpng	5.0	`1.2.27-2+lenny2`	fixed
Opensuse	MozillaThunderbird	tumbleweed	`45.5.1-1.1`	fixed
Opensuse	libpng16	tumbleweed	`1.6.37-3.3`	fixed
Opensuse	MozillaFirefox	tumbleweed	`50.1.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libpng	deb	4.0	`1.2.15~beta5-1+etch2`	Not reported	DSA-1750-1	Not reported
Debian	libpng	deb	5.0	`1.2.27-2+lenny2`	Not reported	DSA-1750-1	Not reported
Opensuse	MozillaThunderbird	rpm	tumbleweed	`45.5.1-1.1`	Not reported	OPENSUSE-SU-2024:10230-1	Not reported
Opensuse	libpng16	rpm	tumbleweed	`1.6.37-3.3`	Not reported	OPENSUSE-SU-2024:10972-1	Not reported
Opensuse	MozillaFirefox	rpm	tumbleweed	`50.1.0-1.1`	Not reported	OPENSUSE-SU-2024:10071-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libpng16-16]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-16-32bit]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-16-x86-64-v3]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-compat-devel]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-compat-devel-32bit]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-compat-devel-x86-64-v3]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-devel]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-devel-32bit]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-devel-x86-64-v3]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[libpng16-tools]Unknown
Source package: [libpng16]
Details (1)
- 1.6.58-1.2 · x86_64 · tumbleweed
  Unknown · Fixed: 1.6.37-3.3
  Version impact unknown
  pypi · libpng16 · opensuse · tumbleweed
[MozillaFirefox-branding-upstream]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 50.1.0-1.1
  Version impact unknown
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaFirefox-devel]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 50.1.0-1.1
  Version impact unknown
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaFirefox-translations-common]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 50.1.0-1.1
  Version impact unknown
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaFirefox-translations-other]Unknown
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 50.1.0-1.1
  Version impact unknown
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaThunderbird-openpgp-librnp]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 45.5.1-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed
[MozillaThunderbird-translations-common]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 45.5.1-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed
[MozillaThunderbird-translations-other]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 45.5.1-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed
[MozillaFirefox]Fixed
Source package: [MozillaFirefox]
Details (1)
- 154.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 50.1.0-1.1
  pypi · MozillaFirefox · opensuse · tumbleweed
[MozillaThunderbird]Fixed
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 45.5.1-1.1
  pypi · MozillaThunderbird · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:04:27 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]