NetSight
IP …
medium6.5

CVE-2011-2501

The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attac…

Impact

The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.

Affected products

VendorProductAffected versions
LibpngLibpng
from 1.0.0 before 1.0.55
from 1.2.0 before 1.2.45
from 1.4.0 before 1.4.8
from 1.5.0 before 1.5.4
FedoraprojectFedora
Version 14
DebianDebian Linux
Versions 5.0, 6.0
CanonicalUbuntu Linux
Versions 8.04, 10.04, 10.10, 11.04

Weakness classification

CWE-125

References