CVE-2011-2690: Buffer Overflow
Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the pngrgbtogray function but not the pngsetexpand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.
Other sources
libpng overwrites unallocated memory when promoting a paletted image with transparency (one channel) to gray-alpha (two channels), only if the application calls pngrgbtogray() but fails to call pngsetexpand().
This bug exists in all released versions of libpng (1.0, 1.2, 1.4 and 1.5). The data overwritten is entirely controlled by the image data in the PNG file and it is possible to cause any string of data to be written by fabricating an appropriate PNG file. The amount of overwrite is equal to the row length of the original image.
This has been fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2011-2690?
CVE-2011-2690 is considered to have a critical severity level due to its potential for remote code execution.
How do I fix CVE-2011-2690?
To fix CVE-2011-2690, update to the recommended versions of libpng: 1.0.55 or higher, 1.2.45 or higher, 1.4.8 or higher, or 1.5.4 or higher.
Which versions of libpng are affected by CVE-2011-2690?
CVE-2011-2690 affects libpng versions 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4.
Can CVE-2011-2690 lead to data loss?
Yes, CVE-2011-2690 can potentially lead to data loss by allowing attackers to overwrite memory.
Is CVE-2011-2690 related to a specific function in libpng?
CVE-2011-2690 specifically arises when an application calls the png_rgb_to_gray function without calling png_set_expand.