GCVE - cpe:2.3:a:optipng_project:optipng:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:optipng_project:optipng:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Optipng Project (`a48f0378-731a-52d3-92a1-683c22c4837b`)
Product	Optipng (`4cb2f2c8-c753-5629-ab76-5f60a885b393`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/ubuntu/optipng`	purl2cpe	2026-06-01 10:12:47.854435
`pkg:docker/struffel/optipng`	purl2cpe	2026-06-01 10:12:47.854439
`pkg:gem/optipng`	purl2cpe	2026-06-01 10:12:47.854442
`pkg:github/martinpoljak/optipng`	purl2cpe	2026-06-01 10:12:47.854444
`pkg:rpm/fedora/optipng`	purl2cpe	2026-06-01 10:12:47.854447
`pkg:rpm/opensuse/optipng`	purl2cpe	2026-06-01 10:12:47.854450
`pkg:sourceforge/optipng`	purl2cpe	2026-06-01 10:12:47.854453

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-3982`	vulnerable	2026-06-08 05:07:46.356827	Details available Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow. Published: 2016-04-13T16:00:00.000Z Updated: 2024-08-06T00:10:31.983Z Open on db.gcve.eu Reference links http://lists.opensuse.org/opensuse-updates/2016-04/msg00065.html http://www.debian.org/security/2016/dsa-3546 http://www.ubuntu.com/usn/USN-2951-1 http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html https://security.gentoo.org/glsa/201608-01	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-3981`	vulnerable	2026-06-08 05:07:46.356087	Details available Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file. Published: 2016-04-13T16:00:00.000Z Updated: 2024-08-06T00:10:31.954Z Open on db.gcve.eu Reference links http://bugs.fi/media/afl/optipng/1/ https://sourceforge.net/p/optipng/bugs/56/ http://lists.opensuse.org/opensuse-updates/2016-04/msg00065.html http://www.debian.org/security/2016/dsa-3546 http://www.ubuntu.com/usn/USN-2951-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-7801`	vulnerable	2026-06-08 05:07:01.954031	Details available Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file. Published: 2016-04-20T16:00:00.000Z Updated: 2024-08-06T07:58:59.987Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2015/09/16/1 https://bugzilla.redhat.com/show_bug.cgi?id=1264015 http://www.ubuntu.com/usn/USN-2951-1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0749`	vulnerable	2026-06-08 04:51:11.071244	Details available Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted GIF image that causes the realloc function to return a new pointer, which triggers memory corruption when the old pointer is accessed. Published: 2009-03-02T20:00:00.000Z Updated: 2024-08-07T04:48:51.609Z Open on db.gcve.eu Reference links http://secunia.com/advisories/34201 http://secunia.com/advisories/34259 http://secunia.com/advisories/34035 http://www.securityfocus.com/bid/33873 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Optipng

Notes

PURL mappings

Vulnerability references

Contribute