VDB
CVE-2011-2501
CVE-2011-2501
PUBLISHED
CVSS 4.300000190734863 MEDIUM
The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.
EPSS 2.25% · 84.9th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
2.25%
84.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| debian | debian_linux | 5.0, 6.0 |
| fedoraproject | fedora | 14 |
| n/a | n/a | * |
| libpng | libpng | 1.5.0, 1.0.0, 1.2.0 |
| canonical | ubuntu_linux | 10.04, 8.04, 10.10 |
Exploit Intelligence
- http://sourceforge.net/mailarchive/forum.php?thread_name=BANLkTikrnU6FJNQYFvwmt78hwpgKPVRd1Q%40mail.gmail.com&forum_name=png-mng-implement (nist-nvd)
- 49660 (circl)
- 45046 (circl)
- USN-1175-1 (circl)
- http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=65e6d5a34f49acdb362a0625a706c6b914e670af (circl)
- MDVSA-2011:151 (circl)
- 48474 (circl)
- https://bugzilla.redhat.com/show_bug.cgi?id=717084 (circl)
- SSA:2011-210-01 (circl)
- GLSA-201206-15 (circl)
…and 13 more exploits
Timeline
- Jul 17, 2011 CVE Published
- Aug 6, 2020 CVE Updated
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Apr 2, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
References
- http://secunia.com/advisories/45460 technical
- http://secunia.com/advisories/45486 technical
- http://secunia.com/advisories/45492 technical
- 49660 third-party-advisory
- 45046 third-party-advisory
- USN-1175-1 vendor-advisory
- http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=65e6d5a34f49acdb362a0625a706c6b914e670af url
- MDVSA-2011:151 vendor-advisory
- 48474 vdb
- https://bugzilla.redhat.com/show_bug.cgi?id=717084 url
- SSA:2011-210-01 vendor-advisory
- GLSA-201206-15 vendor-advisory
- [oss-security] 20110627 CVE request for libpng regression (CVE-2004-0421) mailing-list
- FEDORA-2011-8868 vendor-advisory
- libpng-pngerror-dos(68517) vdb
- 45289 third-party-advisory
- FEDORA-2011-9336 vendor-advisory
- DSA-2287 vendor-advisory
- http://sourceforge.net/mailarchive/forum.php?thread_name=BANLkTikrnU6FJNQYFvwmt78hwpgKPVRd1Q%40mail.gmail.com&forum_name=png-mng-implement url
- 45405 third-party-advisory
…and 5 more