CVE-2011-2501
Fixed in a distro release EPSS 3%
The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.
Products: libpng, fedoraproject fedora, debian_linux, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 5.0 | libpng | 1.2.27-2+lenny5 |
| Debian 6.0 | libpng | 1.2.44-1+squeeze1 |
| Red Hat Enterprise Linux 6 | libpng | 2:1.2.46-1.el6_1 |
| Red Hat Enterprise Linux 6 | libpng-debuginfo | 2:1.2.46-1.el6_1 |
| Red Hat Enterprise Linux 6 | libpng-devel | 2:1.2.46-1.el6_1 |
| Red Hat Enterprise Linux 6 | libpng-static | 2:1.2.46-1.el6_1 |
| openSUSE Tumbleweed | libpng16 | 1.6.26-1.1 |