CVE-2011-3328: Low severity libpng vulnerability
It was reported [1] that libpng 1.5.4 suffered from a flaw when encountering a malformed cHRM chunk in a PNG graphics file. libpng would perform a divide-by-zero, which would cause libpng, or any application linked to libpng, to crash.
This flaw only affected libpng 1.5.4 where it was introduced, and is corrected in version 1.5.5. [2]
[1] http://www.kb.cert.org/vuls/id/477046 [2] http://sourceforge.net/tracker/index.php?func=detail&aid=3406145&groupid=5624&atid=105624
Statement:
Not vulnerable. This issue did not affect the versions of libpng as shipped with Red Hat Enterprise Linux 4, 5, or 6.
Other sources
The pnghandlecHRM function in pngrutil.c in libpng 1.5.4, when color-correction support is enabled, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a malformed PNG image containing a cHRM chunk associated with a certain zero value.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3328?
CVE-2011-3328 has a severity rating of medium due to its ability to cause denial of service through application crashes.
How do I fix CVE-2011-3328?
To fix CVE-2011-3328, upgrade libpng to version 1.5.5 or higher.
Which versions of libpng are affected by CVE-2011-3328?
CVE-2011-3328 specifically affects libpng version 1.5.4.
What type of vulnerability is CVE-2011-3328?
CVE-2011-3328 is categorized as a divide-by-zero vulnerability that leads to application crashes.
Can CVE-2011-3328 impact applications linked to libpng?
Yes, any application linked to the vulnerable version of libpng can be impacted by CVE-2011-3328.