Published: 17/07/2011 Updated: 06/08/2020

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Buffer overflow in libpng 1.0.x prior to 1.0.55, 1.2.x prior to 1.2.45, 1.4.x prior to 1.4.8, and 1.5.x prior to 1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote malicious users to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libpng libpng
fedoraproject fedora 14
debian debian linux 5.0
debian debian linux 6.0
canonical ubuntu linux 8.04
canonical ubuntu linux 10.04
canonical ubuntu linux 10.10
canonical ubuntu linux 11.04

Libpng could be made to run programs as your login if it opened a specially crafted file ...

Debian Bug report logs - #633871 Three security issues Package: libpng; Maintainer for libpng is Anibal Monsalve Salazar <anibal@debianorg>; Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Thu, 14 Jul 2011 15:36:01 UTC Severity: grave Tags: security Fixed in versions libpng/1246-1, libpng/154- ...

Debian Bug report logs - #632786 CVE-2011-2501 libpng: regression of CVE-2004-0421 in 1223+ Package: libpng; Maintainer for libpng is Anibal Monsalve Salazar <anibal@debianorg>; Reported by: Aníbal Monsalve Salazar <anibal@debianorg> Date: Tue, 5 Jul 2011 23:03:02 UTC Severity: critical Tags: patch, security F ...

The PNG library libpng has been affected by several vulnerabilities The most critical one is the identified as CVE-2011-2690 Using this vulnerability, an attacker is able to overwrite memory with an arbitrary amount of data controlled by her via a crafted PNG image The other vulnerabilities are less critical and allow an attacker to cause a cras ...

CWE-120 http://www.openwall.com/lists/oss-security/2011/07/13/2 http://www.libpng.org/pub/png/libpng.html http://secunia.com/advisories/45046 http://www.securityfocus.com/bid/48660 https://bugzilla.redhat.com/show_bug.cgi?id=720607 http://secunia.com/advisories/45461 http://www.redhat.com/support/errata/RHSA-2011-1104.html http://secunia.com/advisories/45415 http://secunia.com/advisories/45460 http://secunia.com/advisories/45405 http://www.redhat.com/support/errata/RHSA-2011-1105.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.html http://www.ubuntu.com/usn/USN-1175-1 http://secunia.com/advisories/45492 http://support.apple.com/kb/HT5002 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:151 http://secunia.com/advisories/49660 http://security.gentoo.org/glsa/glsa-201206-15.xml http://www.debian.org/security/2011/dsa-2287 https://exchange.xforce.ibmcloud.com/vulnerabilities/68538 https://usn.ubuntu.com/1175-1/https://nvd.nist.gov

CVE-2011-2690

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect