Published: 29/05/2012 Updated: 29/12/2017

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The png_set_text_2 function in pngset.c in libpng 1.0.x prior to 1.0.59, 1.2.x prior to 1.2.49, 1.4.x prior to 1.4.11, and 1.5.x prior to 1.5.10 allows remote malicious users to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.

Vulnerable Product	Search on Vulmon	Subscribe to Product
libpng libpng 1.0.57
libpng libpng 1.0.56
libpng libpng 1.0.50
libpng libpng 1.0.48
libpng libpng 1.0.41
libpng libpng 1.0.40
libpng libpng 1.0.32
libpng libpng 1.0.31
libpng libpng 1.0.30
libpng libpng 1.0.23
libpng libpng 1.0.22
libpng libpng 1.0.1
libpng libpng 1.0.0
libpng libpng 1.0.8
libpng libpng 1.0.7
libpng libpng 1.0.58
libpng libpng 1.0.54
libpng libpng 1.0.53
libpng libpng 1.0.45
libpng libpng 1.0.44
libpng libpng 1.0.37
libpng libpng 1.0.35
libpng libpng 1.0.27
libpng libpng 1.0.26
libpng libpng 1.0.19
libpng libpng 1.0.18
libpng libpng 1.0.13
libpng libpng 1.0.12
libpng libpng 1.0.3
libpng libpng 1.0.5
libpng libpng 1.0.52
libpng libpng 1.0.51
libpng libpng 1.0.43
libpng libpng 1.0.42
libpng libpng 1.0.34
libpng libpng 1.0.33
libpng libpng 1.0.25
libpng libpng 1.0.24
libpng libpng 1.0.17
libpng libpng 1.0.16
libpng libpng 1.0.11
libpng libpng 1.0.10
libpng libpng 1.0.9
libpng libpng 1.0.55
libpng libpng 1.0.47
libpng libpng 1.0.46
libpng libpng 1.0.39
libpng libpng 1.0.38
libpng libpng 1.0.29
libpng libpng 1.0.28
libpng libpng 1.0.21
libpng libpng 1.0.20
libpng libpng 1.0.15
libpng libpng 1.0.14
libpng libpng 1.0.6
libpng libpng 1.0.2
libpng libpng 1.2.48
libpng libpng 1.2.47
libpng libpng 1.2.43
libpng libpng 1.2.35
libpng libpng 1.2.34
libpng libpng 1.2.27
libpng libpng 1.2.26
libpng libpng 1.2.19
libpng libpng 1.2.18
libpng libpng 1.2.46
libpng libpng 1.2.45
libpng libpng 1.2.40
libpng libpng 1.2.39
libpng libpng 1.2.38
libpng libpng 1.2.31
libpng libpng 1.2.30
libpng libpng 1.2.23
libpng libpng 1.2.22
libpng libpng 1.2.15
libpng libpng 1.2.14
libpng libpng 1.2.13
libpng libpng 1.2.6
libpng libpng 1.2.5
libpng libpng 1.2.10
libpng libpng 1.2.9
libpng libpng 1.2.3
libpng libpng 1.2.2
libpng libpng 1.2.44
libpng libpng 1.2.37
libpng libpng 1.2.36
libpng libpng 1.2.29
libpng libpng 1.2.28
libpng libpng 1.2.21
libpng libpng 1.2.20
libpng libpng 1.2.12
libpng libpng 1.2.11
libpng libpng 1.2.1
libpng libpng 1.2.4
libpng libpng 1.2.42
libpng libpng 1.2.41
libpng libpng 1.2.33
libpng libpng 1.2.32
libpng libpng 1.2.25
libpng libpng 1.2.24
libpng libpng 1.2.17
libpng libpng 1.2.16
libpng libpng 1.2.8
libpng libpng 1.2.7
libpng libpng 1.2.0
libpng libpng 1.4.10
libpng libpng 1.4.9
libpng libpng 1.4.1
libpng libpng 1.4.0
libpng libpng 1.4.6
libpng libpng 1.4.5
libpng libpng 1.4.8
libpng libpng 1.4.7
libpng libpng 1.4.4
libpng libpng 1.4.3
libpng libpng 1.4.2
libpng libpng 1.5.7
libpng libpng 1.5.3
libpng libpng 1.5.2
libpng libpng 1.5.9
libpng libpng 1.5.5
libpng libpng 1.5.1
libpng libpng 1.5.10
libpng libpng 1.5.6
libpng libpng 1.5.0
libpng libpng 1.5.8
libpng libpng 1.5.4

Synopsis Moderate: libpng security update Type/Severity Security Advisory: Moderate Topic Updated libpng packages that fix one security issue are now available forRed Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common Vulnerabili ...

libpng could be made to crash or run programs as your login if it opened a specially crafted file ...

Debian Bug report logs - #667475 [libpng12-0] CVE-2011-3048: memory corruption flaw Package: libpng12-0; Maintainer for libpng12-0 is Anibal Monsalve Salazar <anibal@debianorg>; Source for libpng12-0 is src:libpng (PTS, buildd, popcon) Reported by: Mario Palomo <mariopal@gmailcom> Date: Wed, 4 Apr 2012 10:57:01 UT ...

Debian Bug report logs - #668082 libpng12-0: libpng-1244 crashes with electric fence memory debugger Package: libpng12-0; Maintainer for libpng12-0 is Anibal Monsalve Salazar <anibal@debianorg>; Source for libpng12-0 is src:libpng (PTS, buildd, popcon) Reported by: Mikulas Patocka <mikulas@artaxkarlinmffcunicz> ...

It was discovered that incorrect memory handling in the png_set_text2() function of the PNG library could lead to the execution of arbitrary code For the stable distribution (squeeze), this problem has been fixed in version libpng_1244-1+squeeze4 For the unstable distribution (sid), this problem will be fixed soon We recommend that you upgrade ...

A heap-based buffer overflow flaw was found in the way libpng processed tEXt chunks in PNG image files An attacker could create a specially-crafted PNG image file that, when opened, could cause an application using libpng to crash or, possibly, execute arbitrary code with the privileges of the user running the application (CVE-2011-3048) ...

CWE-119 http://secunia.com/advisories/48721 http://secunia.com/advisories/48587 http://ubuntu.com/usn/usn-1417-1 http://www.libpng.org/pub/png/libpng.html http://www.debian.org/security/2012/dsa-2446 http://www.osvdb.org/80822 http://rhn.redhat.com/errata/RHSA-2012-0523.html http://secunia.com/advisories/48665 http://secunia.com/advisories/48983 http://www.libpng.org/pub/png/src/libpng-1.5.10-README.txt http://secunia.com/advisories/48644 http://www.securitytracker.com/id?1026879 http://www.securityfocus.com/bid/52830 http://secunia.com/advisories/49660 http://security.gentoo.org/glsa/glsa-201206-15.xml http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077819.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077472.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079039.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079051.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077043.html http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077007.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html http://support.apple.com/kb/HT5501 http://support.apple.com/kb/HT5503 http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html https://exchange.xforce.ibmcloud.com/vulnerabilities/74494 http://www.mandriva.com/security/advisories?name=MDVSA-2012:046 https://access.redhat.com/errata/RHSA-2012:0523 https://usn.ubuntu.com/1417-1/https://nvd.nist.gov

Get Started

CVE-2011-3048

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect