Executive Summary

Informations
Name CVE-2011-3048 First vendor Publication 2012-05-29
Vendor Cve Last vendor Modification 2017-12-29

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3048

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17240
 
Oval ID: oval:org.mitre.oval:def:17240
Title: USN-1417-1 -- libpng vulnerability
Description: libpng could be made to crash or run programs as your login if it opened a specially crafted file.
Family: unix Class: patch
Reference(s): USN-1417-1
CVE-2011-3048
 Version: 7
Platform(s): Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04
Ubuntu 8.04
 Product(s): libpng
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19653
 
Oval ID: oval:org.mitre.oval:def:19653
Title: DSA-2446-1 libpng - incorrect memory handling
Description: It was discovered that incorrect memory handling in the png_set_text2() function of the PNG library could lead to the execution of arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2446-1
CVE-2011-3048
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): libpng
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20704
 
Oval ID: oval:org.mitre.oval:def:20704
Title: RHSA-2012:0523: libpng security update (Moderate)
Description: The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.
Family: unix Class: patch
Reference(s): RHSA-2012:0523-01
CESA-2012:0523
CVE-2011-3048
 Version: 4
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
 Product(s): libpng
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22904
 
Oval ID: oval:org.mitre.oval:def:22904
Title: DEPRECATED: ELSA-2012:0523: libpng security update (Moderate)
Description: The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.
Family: unix Class: patch
Reference(s): ELSA-2012:0523-01
CVE-2011-3048
 Version: 7
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libpng
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23341
 
Oval ID: oval:org.mitre.oval:def:23341
Title: ELSA-2012:0523: libpng security update (Moderate)
Description: The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.
Family: unix Class: patch
Reference(s): ELSA-2012:0523-01
CVE-2011-3048
 Version: 6
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libpng
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27462
 
Oval ID: oval:org.mitre.oval:def:27462
Title: DEPRECATED: ELSA-2012-0523 -- libpng security update (moderate)
Description: [2:1.2.49-1] - Update to libpng 1.2.49, for minor security issues (CVE-2011-3048) Resolves: #812714
Family: unix Class: patch
Reference(s): ELSA-2012-0523
CVE-2011-3048
 Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): libpng
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 143

OpenVAS Exploits

Date Description
2012-09-25 Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2012-004)
File : nvt/gb_macosx_su12-004.nasl
2012-09-10 Name : Slackware Advisory SSA:2012-206-01 libpng
File : nvt/esoft_slk_ssa_2012_206_01.nasl
2012-08-30 Name : Fedora Update for libpng10 FEDORA-2012-4902
File : nvt/gb_fedora_2012_4902_libpng10_fc17.nasl
2012-08-30 Name : Fedora Update for libpng FEDORA-2012-5526
File : nvt/gb_fedora_2012_5526_libpng_fc17.nasl
2012-08-10 Name : Gentoo Security Advisory GLSA 201206-15 (libpng)
File : nvt/glsa_201206_15.nasl
2012-08-03 Name : Mandriva Update for libpng MDVSA-2012:046 (libpng)
File : nvt/gb_mandriva_MDVSA_2012_046.nasl
2012-07-30 Name : CentOS Update for libpng CESA-2012:0523 centos5
File : nvt/gb_CESA-2012_0523_libpng_centos5.nasl
2012-07-30 Name : CentOS Update for libpng CESA-2012:0523 centos6
File : nvt/gb_CESA-2012_0523_libpng_centos6.nasl
2012-04-30 Name : Debian Security Advisory DSA 2446-1 (libpng)
File : nvt/deb_2446_1.nasl
2012-04-30 Name : FreeBSD Ports: png
File : nvt/freebsd_png5.nasl
2012-04-26 Name : RedHat Update for libpng RHSA-2012:0523-01
File : nvt/gb_RHSA-2012_0523-01_libpng.nasl
2012-04-26 Name : Fedora Update for libpng FEDORA-2012-5515
File : nvt/gb_fedora_2012_5515_libpng_fc15.nasl
2012-04-26 Name : Fedora Update for libpng FEDORA-2012-5518
File : nvt/gb_fedora_2012_5518_libpng_fc16.nasl
2012-04-11 Name : Fedora Update for libpng10 FEDORA-2012-5079
File : nvt/gb_fedora_2012_5079_libpng10_fc15.nasl
2012-04-11 Name : Fedora Update for libpng10 FEDORA-2012-5080
File : nvt/gb_fedora_2012_5080_libpng10_fc16.nasl
2012-04-11 Name : Ubuntu Update for libpng USN-1417-1
File : nvt/gb_ubuntu_USN_1417_1.nasl

Nessus® Vulnerability Scanner

Date Description
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_libpng_20130313.nasl - Type : ACT_GATHER_INFO
2014-11-28 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL15881.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2012-217.nasl - Type : ACT_GATHER_INFO
2013-11-13 Name : The remote VMware ESXi 5.1 host is affected by multiple security vulnerabilit...
File : vmware_esxi_5_1_build_911593_remote.nasl - Type : ACT_GATHER_INFO
2013-11-13 Name : The remote VMware ESXi 5.0 host is affected by multiple vulnerabilities.
File : vmware_esxi_5_0_build_912577_remote.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-68.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-0523.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libpng-devel-120330.nasl - Type : ACT_GATHER_INFO
2012-09-27 Name : The remote device is affected by multiple vulnerabilities.
File : appletv_5_1.nasl - Type : ACT_GATHER_INFO
2012-09-20 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_SecUpd2012-004.nasl - Type : ACT_GATHER_INFO
2012-09-20 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_10_7_5.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120425_libpng_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-07-25 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2012-206-01.nasl - Type : ACT_GATHER_INFO
2012-06-25 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201206-15.nasl - Type : ACT_GATHER_INFO
2012-06-14 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_libpng-8043.nasl - Type : ACT_GATHER_INFO
2012-04-26 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0523.nasl - Type : ACT_GATHER_INFO
2012-04-26 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-0523.nasl - Type : ACT_GATHER_INFO
2012-04-25 Name : The remote Fedora host is missing a security update.
File : fedora_2012-5518.nasl - Type : ACT_GATHER_INFO
2012-04-25 Name : The remote Fedora host is missing a security update.
File : fedora_2012-5515.nasl - Type : ACT_GATHER_INFO
2012-04-12 Name : The remote Fedora host is missing a security update.
File : fedora_2012-5526.nasl - Type : ACT_GATHER_INFO
2012-04-12 Name : The remote Fedora host is missing a security update.
File : fedora_2012-4902.nasl - Type : ACT_GATHER_INFO
2012-04-09 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_262b92fe81c811e18899001ec9578670.nasl - Type : ACT_GATHER_INFO
2012-04-09 Name : The remote Fedora host is missing a security update.
File : fedora_2012-5080.nasl - Type : ACT_GATHER_INFO
2012-04-09 Name : The remote Fedora host is missing a security update.
File : fedora_2012-5079.nasl - Type : ACT_GATHER_INFO
2012-04-06 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1417-1.nasl - Type : ACT_GATHER_INFO
2012-04-05 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2446.nasl - Type : ACT_GATHER_INFO
2012-04-02 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-046.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
APPLE http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
BID http://www.securityfocus.com/bid/52830
CONFIRM http://support.apple.com/kb/HT5501
http://support.apple.com/kb/HT5503
http://www.libpng.org/pub/png/libpng.html
http://www.libpng.org/pub/png/src/libpng-1.5.10-README.txt
DEBIAN http://www.debian.org/security/2012/dsa-2446
FEDORA http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077007.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077043.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077472.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077819.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079039.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079051.html
GENTOO http://security.gentoo.org/glsa/glsa-201206-15.xml
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2012:046
OSVDB http://www.osvdb.org/80822
REDHAT http://rhn.redhat.com/errata/RHSA-2012-0523.html
SECTRACK http://www.securitytracker.com/id?1026879
SECUNIA http://secunia.com/advisories/48587
http://secunia.com/advisories/48644
http://secunia.com/advisories/48665
http://secunia.com/advisories/48721
http://secunia.com/advisories/48983
http://secunia.com/advisories/49660
UBUNTU http://ubuntu.com/usn/usn-1417-1
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/74494

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
Date Informations
2021-05-04 12:14:56
  • Multiple Updates
2021-04-22 01:16:15
  • Multiple Updates
2020-05-23 00:30:20
  • Multiple Updates
2017-12-29 09:21:54
  • Multiple Updates
2017-08-29 09:23:26
  • Multiple Updates
2016-06-28 18:46:17
  • Multiple Updates
2016-04-26 20:58:03
  • Multiple Updates
2015-01-21 13:24:54
  • Multiple Updates
2014-11-29 13:27:07
  • Multiple Updates
2014-06-14 13:31:22
  • Multiple Updates
2014-02-17 11:04:25
  • Multiple Updates
2013-05-10 23:05:33
  • Multiple Updates