Executive Summary
Informations | |||
---|---|---|---|
Name | MDVSA-2011:151 | First vendor Publication | 2011-10-17 |
Vendor | Mandriva | Last vendor Modification | 2011-10-17 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Multiple vulnerabilities has been discovered and corrected in libpng: The png_format_buffer function in pngerror.c in libpng allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression (CVE-2011-2501). Buffer overflow in libpng, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image (CVE-2011-2690). The png_err function in pngerror.c in libpng makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image (CVE-2011-2691). NOTE: This does not affect the binary packages in Mandriva, but could affect users if PNG_NO_ERROR_TEXT is defined using the libpng-source-1.?.?? package. The png_handle_sCAL function in pngrutil.c in libpng does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory (CVE-2011-2692). The updated packages have been patched to correct these issues. |
Original Source
Url : http://www.mandriva.com/security/advisories?name=MDVSA-2011:151 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
40 % | CWE-125 | Out-of-bounds Read |
20 % | CWE-476 | NULL Pointer Dereference |
20 % | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE/SANS Top 25) |
20 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:11710 | |||
Oval ID: | oval:org.mitre.oval:def:11710 | ||
Title: | The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. | ||
Description: | The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2004-0421 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:12578 | |||
Oval ID: | oval:org.mitre.oval:def:12578 | ||
Title: | DSA-2287-1 libpng -- several | ||
Description: | The PNG library libpng has been affected by several vulnerabilities. The most critical one is the identified as CVE-2011-2690. Using this vulnerability, an attacker is able to overwrite memory with an arbitrary amount of data controlled by her via a crafted PNG image. The other vulnerabilities are less critical and allow an attacker to cause a crash in the program via a crafted PNG image. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2287-1 CVE-2011-2501 CVE-2011-2690 CVE-2011-2691 CVE-2011-2692 | Version: | 5 |
Platform(s): | Debian GNU/Linux 5.0 Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | libpng |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:14109 | |||
Oval ID: | oval:org.mitre.oval:def:14109 | ||
Title: | USN-1175-1 -- libpng vulnerabilities | ||
Description: | libpng: PNG file library Libpng could be made to run programs as your login if it opened a specially crafted file. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1175-1 CVE-2011-2501 CVE-2011-2690 CVE-2011-2692 | Version: | 5 |
Platform(s): | Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 | Product(s): | libpng |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21411 | |||
Oval ID: | oval:org.mitre.oval:def:21411 | ||
Title: | RHSA-2011:1105: libpng security update (Moderate) | ||
Description: | The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2011:1105-01 CVE-2011-2501 CVE-2011-2690 CVE-2011-2692 | Version: | 42 |
Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | libpng |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:21953 | |||
Oval ID: | oval:org.mitre.oval:def:21953 | ||
Title: | RHSA-2011:1104: libpng security update (Moderate) | ||
Description: | The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2011:1104-01 CESA-2011:1104 CVE-2011-2690 CVE-2011-2692 | Version: | 29 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | libpng |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:22741 | |||
Oval ID: | oval:org.mitre.oval:def:22741 | ||
Title: | ELSA-2011:1104: libpng security update (Moderate) | ||
Description: | The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011:1104-01 CVE-2011-2690 CVE-2011-2692 | Version: | 13 |
Platform(s): | Oracle Linux 5 | Product(s): | libpng |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:22849 | |||
Oval ID: | oval:org.mitre.oval:def:22849 | ||
Title: | ELSA-2011:1105: libpng security update (Moderate) | ||
Description: | The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011:1105-01 CVE-2011-2501 CVE-2011-2690 CVE-2011-2692 | Version: | 17 |
Platform(s): | Oracle Linux 6 | Product(s): | libpng |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27429 | |||
Oval ID: | oval:org.mitre.oval:def:27429 | ||
Title: | DEPRECATED: ELSA-2011-1105 -- libpng security update (moderate) | ||
Description: | [2:1.2.46-1] - Update to libpng 1.2.46, includes fixes for CVE-2011-2501, CVE-2011-2690, CVE-2011-2691, CVE-2011-2692 Resolves: #721305 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011-1105 CVE-2011-2501 CVE-2011-2690 CVE-2011-2692 | Version: | 4 |
Platform(s): | Oracle Linux 6 | Product(s): | libpng |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:28036 | |||
Oval ID: | oval:org.mitre.oval:def:28036 | ||
Title: | DEPRECATED: ELSA-2011-1104 -- libpng security update (moderate) | ||
Description: | [2:1.2.10-7.1.el5_7.5] - Install the correct fix for CVE-2011-2690 Resolves: #721303 [2:1.2.10-7.1.el5_7.4] - Back-port fixes for CVE-2011-2690, CVE-2011-2692 Note: CVE-2011-2691, announced at the same time, does not apply to 1.2.10; likewise for CVE-2011-2501 Resolves: #721303 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011-1104 CVE-2011-2690 CVE-2011-2692 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | libpng |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:971 | |||
Oval ID: | oval:org.mitre.oval:def:971 | ||
Title: | libpng Malformed PNG Image Vulnerability | ||
Description: | The Portable Network Graphics library (libpng) 1.0.15 and earlier allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2004-0421 | Version: | 2 |
Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-09-10 | Name : Slackware Advisory SSA:2011-210-01 libpng File : nvt/esoft_slk_ssa_2011_210_01.nasl |
2012-08-10 | Name : Gentoo Security Advisory GLSA 201206-15 (libpng) File : nvt/glsa_201206_15.nasl |
2012-07-30 | Name : CentOS Update for libpng10 CESA-2011:1103 centos4 x86_64 File : nvt/gb_CESA-2011_1103_libpng10_centos4_x86_64.nasl |
2012-07-30 | Name : CentOS Update for libpng CESA-2011:1104 centos5 x86_64 File : nvt/gb_CESA-2011_1104_libpng_centos5_x86_64.nasl |
2012-07-09 | Name : RedHat Update for libpng RHSA-2011:1105-01 File : nvt/gb_RHSA-2011_1105-01_libpng.nasl |
2012-05-18 | Name : Mac OS X Multiple Vulnerabilities (2012-002) File : nvt/gb_macosx_su12-002.nasl |
2012-04-26 | Name : Fedora Update for libpng FEDORA-2012-5515 File : nvt/gb_fedora_2012_5515_libpng_fc15.nasl |
2012-04-11 | Name : Fedora Update for libpng10 FEDORA-2012-5079 File : nvt/gb_fedora_2012_5079_libpng10_fc15.nasl |
2012-04-02 | Name : Fedora Update for libpng FEDORA-2012-3705 File : nvt/gb_fedora_2012_3705_libpng_fc15.nasl |
2012-04-02 | Name : Fedora Update for libpng10 FEDORA-2012-3536 File : nvt/gb_fedora_2012_3536_libpng10_fc15.nasl |
2012-03-07 | Name : Fedora Update for libpng10 FEDORA-2012-2008 File : nvt/gb_fedora_2012_2008_libpng10_fc15.nasl |
2012-03-07 | Name : Fedora Update for libpng FEDORA-2012-1930 File : nvt/gb_fedora_2012_1930_libpng_fc15.nasl |
2011-10-21 | Name : Mandriva Update for libpng MDVSA-2011:151 (libpng) File : nvt/gb_mandriva_MDVSA_2011_151.nasl |
2011-10-20 | Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2011-006) File : nvt/gb_macosx_su11-006.nasl |
2011-09-23 | Name : CentOS Update for libpng CESA-2011:1104 centos5 i386 File : nvt/gb_CESA-2011_1104_libpng_centos5_i386.nasl |
2011-08-31 | Name : Fedora Update for mingw32-libpng FEDORA-2011-10954 File : nvt/gb_fedora_2011_10954_mingw32-libpng_fc14.nasl |
2011-08-31 | Name : Fedora Update for mingw32-libpng FEDORA-2011-10928 File : nvt/gb_fedora_2011_10928_mingw32-libpng_fc15.nasl |
2011-08-18 | Name : CentOS Update for libpng10 CESA-2011:1103 centos4 i386 File : nvt/gb_CESA-2011_1103_libpng10_centos4_i386.nasl |
2011-08-07 | Name : Debian Security Advisory DSA 2287-1 (libpng) File : nvt/deb_2287_1.nasl |
2011-08-02 | Name : Fedora Update for libpng FEDORA-2011-9336 File : nvt/gb_fedora_2011_9336_libpng_fc14.nasl |
2011-08-02 | Name : RedHat Update for libpng RHSA-2011:1104-01 File : nvt/gb_RHSA-2011_1104-01_libpng.nasl |
2011-08-02 | Name : RedHat Update for libpng RHSA-2011:1103-01 File : nvt/gb_RHSA-2011_1103-01_libpng.nasl |
2011-08-02 | Name : Ubuntu Update for libpng USN-1175-1 File : nvt/gb_ubuntu_USN_1175_1.nasl |
2011-07-27 | Name : Fedora Update for libpng10 FEDORA-2011-8844 File : nvt/gb_fedora_2011_8844_libpng10_fc15.nasl |
2011-07-27 | Name : Fedora Update for libpng10 FEDORA-2011-8867 File : nvt/gb_fedora_2011_8867_libpng10_fc14.nasl |
2011-07-22 | Name : Fedora Update for libpng FEDORA-2011-9343 File : nvt/gb_fedora_2011_9343_libpng_fc15.nasl |
2011-07-18 | Name : Fedora Update for mingw32-libpng FEDORA-2011-8868 File : nvt/gb_fedora_2011_8868_mingw32-libpng_fc14.nasl |
2011-07-18 | Name : Fedora Update for mingw32-libpng FEDORA-2011-8874 File : nvt/gb_fedora_2011_8874_mingw32-libpng_fc15.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200405-06 (libpng) File : nvt/glsa_200405_06.nasl |
2008-09-04 | Name : FreeBSD Ports: linux-png File : nvt/freebsd_linux-png.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 498-1 (libpng, libpng3) File : nvt/deb_498_1.nasl |
0000-00-00 | Name : Slackware Advisory SSA:2004-124-04 libpng update File : nvt/esoft_slk_ssa_2004_124_04.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
73984 | libpng png_rgb_to_gray Function PNG File Handling Overflow |
73983 | libpng pngerror.c png_err Function NULL Argument PNG File Handling DoS |
73982 | libpng pngrutil.c png_handle_sCAL Function PNG File Handling Memory Corruptio... |
73493 | libpng pngerror.c png_format_buffer() Off-by-one PNG Image Handling Remote DoS |
5726 | libpng Malformed PNG Image Error Handling DoS libpng contains a flaw that may allow a remote denial of service. The issue is triggered when the library process a malformed PNG image and attempts to use memory it has not allocated for an error message. The application using the libpng library will crash resulting in loss of availability. |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_libpng14-110802.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_libpng12-110802.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_libpng14-110802.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_libpng12-110802.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1103.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1104.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1105.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110728_libpng_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110728_libpng_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110728_libpng_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-06-25 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-15.nasl - Type : ACT_GATHER_INFO |
2012-05-10 | Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_SecUpd2012-002.nasl - Type : ACT_GATHER_INFO |
2011-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libpng-7670.nasl - Type : ACT_GATHER_INFO |
2011-10-18 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-151.nasl - Type : ACT_GATHER_INFO |
2011-10-13 | Name : The remote host is missing a Mac OS X update that fixes several security issues. File : macosx_10_7_2.nasl - Type : ACT_GATHER_INFO |
2011-10-13 | Name : The remote host is missing a Mac OS X update that fixes several security issues. File : macosx_SecUpd2011-006.nasl - Type : ACT_GATHER_INFO |
2011-09-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-1104.nasl - Type : ACT_GATHER_INFO |
2011-08-29 | Name : The remote Fedora host is missing a security update. File : fedora_2011-10954.nasl - Type : ACT_GATHER_INFO |
2011-08-29 | Name : The remote Fedora host is missing a security update. File : fedora_2011-10928.nasl - Type : ACT_GATHER_INFO |
2011-08-18 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12815.nasl - Type : ACT_GATHER_INFO |
2011-08-18 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libpng-devel-110802.nasl - Type : ACT_GATHER_INFO |
2011-08-18 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libpng-7669.nasl - Type : ACT_GATHER_INFO |
2011-08-15 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-1103.nasl - Type : ACT_GATHER_INFO |
2011-08-01 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2011-210-01.nasl - Type : ACT_GATHER_INFO |
2011-08-01 | Name : The remote Fedora host is missing a security update. File : fedora_2011-9336.nasl - Type : ACT_GATHER_INFO |
2011-07-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2287.nasl - Type : ACT_GATHER_INFO |
2011-07-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1103.nasl - Type : ACT_GATHER_INFO |
2011-07-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1104.nasl - Type : ACT_GATHER_INFO |
2011-07-29 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1105.nasl - Type : ACT_GATHER_INFO |
2011-07-27 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1175-1.nasl - Type : ACT_GATHER_INFO |
2011-07-25 | Name : The remote Fedora host is missing a security update. File : fedora_2011-8844.nasl - Type : ACT_GATHER_INFO |
2011-07-25 | Name : The remote Fedora host is missing a security update. File : fedora_2011-8867.nasl - Type : ACT_GATHER_INFO |
2011-07-19 | Name : The remote Fedora host is missing a security update. File : fedora_2011-9343.nasl - Type : ACT_GATHER_INFO |
2011-07-18 | Name : The remote Fedora host is missing a security update. File : fedora_2011-8868.nasl - Type : ACT_GATHER_INFO |
2011-07-18 | Name : The remote Fedora host is missing a security update. File : fedora_2011-8874.nasl - Type : ACT_GATHER_INFO |
2009-04-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3a408f6f9c5211d893660020ed76ef5a.nasl - Type : ACT_GATHER_INFO |
2007-02-18 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2006-212.nasl - Type : ACT_GATHER_INFO |
2007-02-18 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-213.nasl - Type : ACT_GATHER_INFO |
2005-07-13 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-124-04.nasl - Type : ACT_GATHER_INFO |
2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-498.nasl - Type : ACT_GATHER_INFO |
2004-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200405-06.nasl - Type : ACT_GATHER_INFO |
2004-08-10 | Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd20040809.nasl - Type : ACT_GATHER_INFO |
2004-07-31 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-040.nasl - Type : ACT_GATHER_INFO |
2004-07-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-106.nasl - Type : ACT_GATHER_INFO |
2004-07-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-105.nasl - Type : ACT_GATHER_INFO |
2004-07-06 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-180.nasl - Type : ACT_GATHER_INFO |
2004-07-06 | Name : The remote host is using an unsupported version of Mac OS X. File : macosx_version.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:42:29 |
|