The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.

According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The png_set_text_2 function in pngset.c in libpng 1.0.x     before 1.0.59, 1.2.x before 1.2.49, 1.4.x before     1.4.11, and 1.5.x before 1.5.10 allows remote attackers     to cause a denial of service (crash) or execute     arbitrary code via a crafted text chunk in a PNG image     file, which triggers a memory allocation failure that     is not properly handled, leading to a heap-based buffer     overflow.(CVE-2011-3048)

  - The png_handle_sCAL function in pngrutil.c in libpng     1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before     1.4.8, and 1.5.x before 1.5.4 does not properly handle     invalid sCAL chunks, which allows remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly have unspecified other     impact via a crafted PNG image that triggers the     reading of uninitialized memory.(CVE-2011-2692)

  - It was discovered that the png_get_PLTE() and     png_set_PLTE() functions of libpng did not correctly     calculate the maximum palette sizes for bit depths of     less than 8. In case an application tried to use these     functions in combination with properly calculated     palette sizes, this could lead to a buffer overflow or     out-of-bounds reads. An attacker could exploit this to     cause a crash or potentially execute arbitrary code by     tricking an unsuspecting user into processing a     specially crafted PNG image. However, the exact impact     is dependent on the application using the     library.(CVE-2015-8472)

  - The png_err function in pngerror.c in libpng 1.0.x     before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8,     and 1.5.x before 1.5.4 makes a function call using a     NULL pointer argument instead of an empty-string     argument, which allows remote attackers to cause a     denial of service (application crash) via a crafted PNG     image.(CVE-2011-2691)

  - Integer underflow in the png_check_keyword function in     pngwutil.c in libpng 0.90 through 0.99, 1.0.x before     1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x     before 1.4.19, and 1.5.x before 1.5.26 allows remote     attackers to have unspecified impact via a space     character as a keyword in a PNG image, which triggers     an out-of-bounds read.(CVE-2015-8540)

  - Integer overflow in libpng, as used in Google Chrome     before 17.0.963.56, allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via unknown vectors that trigger an integer     truncation.(CVE-2011-3026)

  - An array-indexing error was discovered in the     png_convert_to_rfc1123() function of libpng. An     attacker could possibly use this flaw to cause an     out-of-bounds read by tricking an unsuspecting user     into processing a specially crafted PNG     image.(CVE-2015-7981)

  - Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x     before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before     1.5.4, when used by an application that calls the     png_rgb_to_gray function but not the png_set_expand     function, allows remote attackers to overwrite memory     with an arbitrary amount of data, and possibly have     unspecified other impact, via a crafted PNG     image.(CVE-2011-2690)

  - The png_format_buffer function in pngerror.c in libpng     1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before     1.4.8, and 1.5.x before 1.5.4 allows remote attackers     to cause a denial of service (application crash) via a     crafted PNG image that triggers an out-of-bounds read     during the copying of error-message data. NOTE: this     vulnerability exists because of a CVE-2004-0421     regression. NOTE: this is called an off-by-one error by     some sources.(CVE-2011-2501)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of libpng14-14 fixes :

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng12-0 fixes :

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

From Red Hat Security Advisory 2011:1105 :

Updated libpng packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A buffer overflow flaw was found in the way libpng processed certain PNG image files. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2011-2690)

Note: The application behavior required to exploit CVE-2011-2690 is rarely used. No application shipped with Red Hat Enterprise Linux behaves this way, for example.

An out-of-bounds memory read flaw was found in the way libpng processed certain PNG image files. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash. (CVE-2011-2501)

An uninitialized memory read issue was found in the way libpng processed certain PNG images that use the Physical Scale (sCAL) extension. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash.
(CVE-2011-2692)

Users of libpng should upgrade to these updated packages, which upgrade libpng to version 1.2.46 to correct these issues. All running applications using libpng must be restarted for the update to take effect.

The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A buffer overflow flaw was found in the way libpng processed certain PNG image files. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2011-2690)

Note: The application behavior required to exploit CVE-2011-2690 is rarely used. No application shipped with Scientific Linux behaves this way, for example.

An out-of-bounds memory read flaw was found in the way libpng processed certain PNG image files. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash. (CVE-2011-2501)

An uninitialized memory read issue was found in the way libpng processed certain PNG images that use the Physical Scale (sCAL) extension. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash.
(CVE-2011-2692)

Users of libpng should upgrade to these updated packages, which upgrade libpng to version 1.2.46 to correct these issues. All running applications using libpng must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201206-15 (libpng: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libpng:
      The &ldquo;embedded_profile_len()&rdquo; function in pngwutil.c does not         check for negative values, resulting in a memory leak (CVE-2009-5063).
      The &ldquo;png_format_buffer()&rdquo; function in pngerror.c contains an         off-by-one error (CVE-2011-2501).
      The &ldquo;png_rgb_to_gray()&rdquo; function in pngrtran.c contains an         integer overflow error (CVE-2011-2690).
      The &ldquo;png_err()&rdquo; function in pngerror.c contains a NULL pointer         dereference error (CVE-2011-2691).
      The &ldquo;png_handle_sCAL()&rdquo; function in pngrutil.c improperly handles         malformed sCAL chunks(CVE-2011-2692).
      The &ldquo;png_decompress_chunk()&rdquo; function in pngrutil.c contains an         integer overflow error (CVE-2011-3026).
      The &ldquo;png_inflate()&rdquo; function in pngrutil.c contains and out of         bounds error (CVE-2011-3045).
      The &ldquo;png_set_text_2()&rdquo; function in pngset.c contains an error         which could result in memory corruption (CVE-2011-3048).
      The &ldquo;png_formatted_warning()&rdquo; function in pngerror.c contains an         off-by-one error (CVE-2011-3464).
  Impact :

    An attacker could exploit these vulnerabilities to execute arbitrary       code with the permissions of the user running the vulnerable program,       which could be the root user, or to cause programs linked against the       library to crash.
  Workaround :

    There is no known workaround at this time.

This update of libpng fixes :

  - CVE-2008-6218: CVSS v2 Base Score: 7.1     (AV:N/AC:M/Au:N/C:N/I:N/A:C): Resource Management Errors     (CWE-399)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

Multiple vulnerabilities has been discovered and corrected in libpng :

The png_format_buffer function in pngerror.c in libpng allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression (CVE-2011-2501).

Buffer overflow in libpng, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image (CVE-2011-2690).

The png_err function in pngerror.c in libpng makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image (CVE-2011-2691). NOTE:
This does not affect the binary packages in Mandriva, but could affect users if PNG_NO_ERROR_TEXT is defined using the libpng-source-1.?.?? package.

The png_handle_sCAL function in pngrutil.c in libpng does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory (CVE-2011-2692).

The updated packages have been patched to correct these issues.

This update of libpng12-0 fixes :

  - CVE-2008-6218: CVSS v2 Base Score: 7.1     (AV:N/AC:M/Au:N/C:N/I:N/A:C): Resource Management Errors     (CWE-399)

  - unknown (unknown). (CVE-2009-5063: CVSS v2 Base Score:
    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P))

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng fixes :

  - CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C):
    Resource Management Errors (CWE-399). (CVE-2008-6218)

  - CVSS v2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P):
    Buffer Errors (CWE-119). (CVE-2011-2690)

  - CVSS v2 Base Score: 5.0 (AV:N/AC:M/Au:N/C:N/I:N/A:P):
    Buffer Errors (CWE-119). (CVE-2011-2692)

Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690, CVE-2011-2691, CVE-2011-2692

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libpng packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1105 advisory.

  - libpng: regression of CVE-2004-0421 in 1.2.23+ (CVE-2011-2501)

  - libpng: buffer overwrite in png_rgb_to_gray (CVE-2011-2690)

  - libpng: Invalid read when handling empty sCAL chunks (CVE-2011-2692)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The PNG library libpng has been affected by several vulnerabilities.
The most critical one is the identified as CVE-2011-2690. Using this vulnerability, an attacker is able to overwrite memory with an arbitrary amount of data controlled by her via a crafted PNG image.

The other vulnerabilities are less critical and allow an attacker to cause a crash in the program (denial of service) via a crafted PNG image.

Frank Busse discovered that libpng did not properly handle certain malformed PNG images. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause libpng to crash, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS, 10.10, and 11.04. (CVE-2011-2501)

It was discovered that libpng did not properly handle certain malformed PNG images. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-2690)

Frank Busse discovered that libpng did not properly handle certain PNG images with invalid sCAL chunks. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-2692).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes a 1-byte uninitialized memory reference in png_format_buffer(). It allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. This is CVE-2011-2501.

Also fixed in this release are some other minor security problems and there's additionally a bugfix backported from 1.5.3: when expanding a paletted image, always expand to RGBA if transparency is present.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2011-2501.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124924	EulerOS Virtualization 3.0.1.0 : libpng (EulerOS-SA-2019-1421)	Nessus	Huawei Local Security Checks	high
75913	openSUSE Security Update : libpng14 (libpng14-4949)	Nessus	SuSE Local Security Checks	high
75911	openSUSE Security Update : libpng12 (libpng12-4947)	Nessus	SuSE Local Security Checks	high
75604	openSUSE Security Update : libpng14 (libpng14-4949)	Nessus	SuSE Local Security Checks	high
75603	openSUSE Security Update : libpng12 (libpng12-4947)	Nessus	SuSE Local Security Checks	high
68318	Oracle Linux 6 : libpng (ELSA-2011-1105)	Nessus	Oracle Linux Local Security Checks	medium
61101	Scientific Linux Security Update : libpng on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
59668	GLSA-201206-15 : libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
57218	SuSE 10 Security Update : libpng (ZYPP Patch Number 7670)	Nessus	SuSE Local Security Checks	high
56529	Mandriva Linux Security Advisory : libpng (MDVSA-2011:151)	Nessus	Mandriva Local Security Checks	medium
55897	SuSE 10 Security Update : libpng (ZYPP Patch Number 7669)	Nessus	SuSE Local Security Checks	high
55896	SuSE 11.1 Security Update : libpng (SAT Patch Number 4948)	Nessus	SuSE Local Security Checks	high
55895	SuSE9 Security Update : libpng (YOU Patch Number 12815)	Nessus	SuSE Local Security Checks	high
55738	Fedora 14 : libpng-1.2.46-1.fc14 (2011-9336)	Nessus	Fedora Local Security Checks	medium
55735	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 8.1 / 9.0 / 9.1 / current : libpng (SSA:2011-210-01)	Nessus	Slackware Local Security Checks	medium
55727	RHEL 6 : libpng (RHSA-2011:1105)	Nessus	Red Hat Local Security Checks	high
55721	Debian DSA-2287-1 : libpng - several vulnerabilities	Nessus	Debian Local Security Checks	medium
55699	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : libpng vulnerabilities (USN-1175-1)	Nessus	Ubuntu Local Security Checks	medium
55655	Fedora 14 : libpng10-1.0.55-1.fc14 (2011-8867)	Nessus	Fedora Local Security Checks	medium
55654	Fedora 15 : libpng10-1.0.55-1.fc15 (2011-8844)	Nessus	Fedora Local Security Checks	medium
55612	Fedora 15 : libpng-1.2.46-1.fc15 (2011-9343)	Nessus	Fedora Local Security Checks	medium
55600	Fedora 15 : mingw32-libpng-1.4.3-3.fc15 (2011-8874)	Nessus	Fedora Local Security Checks	medium
55599	Fedora 14 : mingw32-libpng-1.4.3-2.fc14 (2011-8868)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-2501

medium

Tenable Plugins

high

high

high

high

high

medium

medium

high

high

medium

high

high

high

medium

medium

high

medium

medium

medium

medium

medium

medium

medium