PT-2012-1123 · Libpng · Libpng

Published 2012-06-22 · Updated 2012-07-23 · CVE-2011-3464

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libpng versions 1.5.4 through 1.5.7 libpng versions prior to 1.5.10

Description The issue is related to an off-by-one error in the png formatted warning function in pngerror.c, which might allow remote attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors, triggering a stack-based buffer overflow. Multiple vulnerabilities in the libpng package can lead to violations of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions 1.5.4 through 1.5.7, update to a version prior to 1.5.10. For versions prior to 1.5.10, update to version 1.5.10 or later.

Fix

Memory Leak

Weakness Enumeration

CWE-401

CWE-189

Related Identifiers

BDU:2015-09650

CVE-2011-3464

Affected Products

Libpng

References · 6

• http://secunia.com/advisories/47827 · Vendor Advisory
• http://secunia.com/advisories/49660 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201206-15.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09650 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-3464 · Security Note
• http://libpng.org/pub/png/libpng.html · Note