CVE-2011-2691medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
References
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.html
http://marc.info/?l=bugtraq&m=133951357207000&w=2
http://secunia.com/advisories/45046
http://secunia.com/advisories/45405
http://secunia.com/advisories/45492
http://secunia.com/advisories/49660
http://security.gentoo.org/glsa/glsa-201206-15.xml
http://support.apple.com/kb/HT5002
http://www.debian.org/security/2011/dsa-2287
http://www.libpng.org/pub/png/libpng.html
http://www.mandriva.com/security/advisories?name=MDVSA-2011:151
http://www.openwall.com/lists/oss-security/2011/07/13/2
http://www.securityfocus.com/bid/48660
Details
Source: MITRE
Published: 2011-07-17
Updated: 2020-08-06
Type: CWE-476
Risk Information
CVSS v2
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3
Base Score: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 2.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
Configuration 2
OR
Configuration 3
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 124924 | EulerOS Virtualization 3.0.1.0 : libpng (EulerOS-SA-2019-1421) | Nessus | Huawei Local Security Checks | high |
| 75913 | openSUSE Security Update : libpng14 (libpng14-4949) | Nessus | SuSE Local Security Checks | high |
| 75911 | openSUSE Security Update : libpng12 (libpng12-4947) | Nessus | SuSE Local Security Checks | high |
| 75604 | openSUSE Security Update : libpng14 (libpng14-4949) | Nessus | SuSE Local Security Checks | high |
| 75603 | openSUSE Security Update : libpng12 (libpng12-4947) | Nessus | SuSE Local Security Checks | high |
| 59668 | GLSA-201206-15 : libpng: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 57218 | SuSE 10 Security Update : libpng (ZYPP Patch Number 7670) | Nessus | SuSE Local Security Checks | high |
| 56529 | Mandriva Linux Security Advisory : libpng (MDVSA-2011:151) | Nessus | Mandriva Local Security Checks | medium |
| 6039 | Mac OS X 10.7 < 10.7.2 Multiple Vulnerabilities | Nessus Network Monitor | Generic | critical |
| 56481 | Mac OS X Multiple Vulnerabilities (Security Update 2011-006) | Nessus | MacOS X Local Security Checks | critical |
| 56480 | Mac OS X 10.7.x < 10.7.2 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 55897 | SuSE 10 Security Update : libpng (ZYPP Patch Number 7669) | Nessus | SuSE Local Security Checks | high |
| 55896 | SuSE 11.1 Security Update : libpng (SAT Patch Number 4948) | Nessus | SuSE Local Security Checks | high |
| 55895 | SuSE9 Security Update : libpng (YOU Patch Number 12815) | Nessus | SuSE Local Security Checks | high |
| 55738 | Fedora 14 : libpng-1.2.46-1.fc14 (2011-9336) | Nessus | Fedora Local Security Checks | medium |
| 55721 | Debian DSA-2287-1 : libpng - several vulnerabilities | Nessus | Debian Local Security Checks | medium |
| 55655 | Fedora 14 : libpng10-1.0.55-1.fc14 (2011-8867) | Nessus | Fedora Local Security Checks | medium |
| 55654 | Fedora 15 : libpng10-1.0.55-1.fc15 (2011-8844) | Nessus | Fedora Local Security Checks | medium |
| 55612 | Fedora 15 : libpng-1.2.46-1.fc15 (2011-9343) | Nessus | Fedora Local Security Checks | medium |