CVE-2011-2690 - CVE House
Back to Database
Status published High CVE-2011-2690

Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45,...

Vulnerability Description

Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-2690

Credits & Attribution

No credits recorded in the NVD database.

References

More from libpng

View All →
CVE-2019-7317
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a...
Unknown 0
CVE-2019-6129
png_create_info_struct in png.c in libpng 1.6.36 has a memory leak,...
Unknown 0
CVE-2018-14550
An issue has been found in third-party PNM decoding associated...
High 8.8
CVE-2018-14048
An issue has been found in libpng 1.6.34. It is...
Medium 6.5
CVE-2018-13785
In libpng 1.6.34, a wrong calculation of row_factor in the...
Unknown 0

Affected Vendor

Affected Software

libpng, fedora, debian linux, ubuntu linux
Vulnerable Versions:
1.0.0, 1.2.0, 1.4.0, 1.5.0, 14, 5.0, 6.0, 8.04, 10.04, 10.10, 11.04

Timeline

Official Publish: July 17th, 2011
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.