REDHAT-BUG-720607
First published: Tue Jul 12 2011(Updated: )
libpng overwrites unallocated memory when promoting a paletted image with transparency (one channel) to gray-alpha (two channels), only if the application calls png_rgb_to_gray() but fails to call png_set_expand(). This bug exists in all released versions of libpng (1.0, 1.2, 1.4 and 1.5). The data overwritten is entirely controlled by the image data in the PNG file and it is possible to cause any string of data to be written by fabricating an appropriate PNG file. The amount of overwrite is equal to the row length of the original image. This has been fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45, and libpng-1.0.55.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Libp2p | <1.0.55 | |
| Libp2p | <1.2.45 | |
| Libp2p | <1.4.8 | |
| Libp2p | <1.5.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2011-2690
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=721307
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=721309
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=721310
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=721311
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=721312
- https://rhn.redhat.com/errata/RHSA-2011-1104.html
- https://rhn.redhat.com/errata/RHSA-2011-1105.html
- https://bugzilla.redhat.com/show_bug.cgi?id=720607
Frequently Asked Questions
What is the severity of REDHAT-BUG-720607?
The severity of REDHAT-BUG-720607 is considered critical due to the potential for memory corruption.
How do I fix REDHAT-BUG-720607?
To fix REDHAT-BUG-720607, applications must ensure that they call png_set_expand() before calling png_rgb_to_gray() when promoting paletted images.
Which versions of libpng are affected by REDHAT-BUG-720607?
All released versions of libpng, including 1.0, 1.2, 1.4, and 1.5, are affected by REDHAT-BUG-720607.
What is the root cause of REDHAT-BUG-720607?
The root cause of REDHAT-BUG-720607 is the overwriting of unallocated memory when the necessary expansion functions are not called during image format promotion.
Is REDHAT-BUG-720607 present in any specific applications?
Yes, REDHAT-BUG-720607 can be present in any application that utilizes affected versions of libpng without following proper usage practices.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-2690
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/libpng
- canonical/libp2p