#VU44882 Buffer overflow in libpng - CVE-2011-2690
Vulnerability identifier: #VU44882
Vulnerability risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID:
CWE-ID:
CWE-120
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
libpng
Universal components / Libraries /
Libraries used by multiple products
Vendor: libpng
Description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.
Mitigation
Install update from vendor's website.
Vulnerable software versions
libpng: 1.5.0 - 1.5.3
External links
https://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
https://lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.html
https://secunia.com/advisories/45046
https://secunia.com/advisories/45405
https://secunia.com/advisories/45415
https://secunia.com/advisories/45460
https://secunia.com/advisories/45461
https://secunia.com/advisories/45492
https://secunia.com/advisories/49660
https://security.gentoo.org/glsa/glsa-201206-15.xml
https://support.apple.com/kb/HT5002
https://www.debian.org/security/2011/dsa-2287
https://www.libpng.org/pub/png/libpng.html
https://www.mandriva.com/security/advisories?name=MDVSA-2011:151
https://www.openwall.com/lists/oss-security/2011/07/13/2
https://www.redhat.com/support/errata/RHSA-2011-1104.html
https://www.redhat.com/support/errata/RHSA-2011-1105.html
https://www.securityfocus.com/bid/48660
https://www.ubuntu.com/usn/USN-1175-1
https://bugzilla.redhat.com/show_bug.cgi?id=720607
https://exchange.xforce.ibmcloud.com/vulnerabilities/68538
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
