CVE-2011-2690

Published: Jul 17, 2011Modified: Apr 29, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.

Affected (11)

Products: Libpng: Libpng · Fedoraproject: Fedora · Debian: Debian Linux · +1 more

Show all products

Libpng: Libpng · Fedoraproject: Fedora · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Libpng Libpng	From 1.0.0 to 1.0.55
Libpng Libpng	From 1.2.0 to 1.2.45
Libpng Libpng	From 1.4.0 to 1.4.8
Libpng Libpng	From 1.5.0 to 1.5.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 14

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 11.04
Canonical Ubuntu Linux	Version 8.04

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (42)

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/45046

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/45405

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/45415

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/45460

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/45461

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/45492

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/49660

Source: secalert@redhat.com

Broken Link

http://security.gentoo.org/glsa/glsa-201206-15.xml

Source: secalert@redhat.com

Third Party Advisory

http://support.apple.com/kb/HT5002

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2011/dsa-2287

Source: secalert@redhat.com

Third Party Advisory

http://www.libpng.org/pub/png/libpng.html

Source: secalert@redhat.com

ProductVendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:151

Source: secalert@redhat.com

Broken Link

http://www.openwall.com/lists/oss-security/2011/07/13/2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.redhat.com/support/errata/RHSA-2011-1104.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2011-1105.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/bid/48660

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1175-1

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=720607

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/68538

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html