CVE-2011-2691: Null Pointer Dereference
It was found that in libpng, prior to 1.2.45, the error function received a NULL pointer, expressed erroneously as '\0', instead of the empty string "". This error was introduced in libpng-1.2.20, and pngdefaulterror() will crash in this case.
This was be fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.
Patch: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9dad5e37aef295b4ef8dea39392b652deebc9261
Other sources
The pngerr function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2691?
CVE-2011-2691 is classified as a high severity vulnerability due to the potential for crashes in applications using the affected versions of libpng.
How do I fix CVE-2011-2691?
To fix CVE-2011-2691, upgrade to libpng version 1.5.4 or later, or version 1.4.8 or later.
Which versions of libpng are affected by CVE-2011-2691?
CVE-2011-2691 affects libpng versions from 1.0.0 up to 1.2.45, as well as certain versions in the 1.4.x and 1.5.x series.
What causes the vulnerability in CVE-2011-2691?
The vulnerability in CVE-2011-2691 is caused by the error function receiving a NULL pointer, leading to application crashes.
Is my system vulnerable to CVE-2011-2691 if I use Fedora or Debian?
Yes, certain versions of Fedora and Debian that include affected libpng versions are vulnerable to CVE-2011-2691.