CVE-2011-2692: Buffer Overflow
It was found that libpng read uninitialized memory when it encountered a sCAL chunk that is empty, and improperly handles a sCAL chunk that lacks the terminating zero between the two strings that it conveys.
This was fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.
Patch: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=61a2d8a2a7b03023e63eae9a3e64607aaaa6d339
Other sources
The pnghandlesCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2692?
CVE-2011-2692 is considered to have a moderate severity due to potential information disclosure risks.
How do I fix CVE-2011-2692?
To fix CVE-2011-2692, upgrade to libpng versions 1.5.4, 1.4.8, 1.2.45, or 1.0.55.
Which software versions are affected by CVE-2011-2692?
CVE-2011-2692 affects libpng versions from 1.0.0 to 1.5.3 and various Linux distributions using these versions.
What types of vulnerabilities are associated with CVE-2011-2692?
CVE-2011-2692 is associated with uninitialized memory read vulnerabilities that may lead to information leakage.
Is CVE-2011-2692 exploitable in a typical environment?
Yes, CVE-2011-2692 is exploitable in environments where untrusted PNG files are processed by affected versions of libpng.