CVE-2011-2501

Public Exploit

Description

The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.

Category

6.5
CVSS
Severity: Medium
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.57%
Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory slackware.com Vendor Advisory gentoo.org Vendor Advisory fedoraproject.org Vendor Advisory fedoraproject.org Vendor Advisory debian.org Vendor Advisory redhat.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://secunia.com/advisories/49660 third party advisory broken link
http://secunia.com/advisories/45046 third party advisory broken link
http://www.ubuntu.com/usn/USN-1175-1 third party advisory vendor advisory
http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=65e6d5a34f49acdb362a0625a706c6b914e670af
http://www.mandriva.com/security/advisories?name=MDVSA-2011:151 vendor advisory broken link
http://www.securityfocus.com/bid/48474 third party advisory vdb entry
https://bugzilla.redhat.com/show_bug.cgi?id=717084 patch third party advisory issue tracking
http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.617466 patch vendor advisory mailing list third party advisory
http://security.gentoo.org/glsa/glsa-201206-15.xml third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2011/06/27/13 patch mailing list third party advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062720.html vendor advisory mailing list third party advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/68517 third party advisory vdb entry
http://secunia.com/advisories/45289 third party advisory broken link
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.html vendor advisory mailing list third party advisory
http://www.debian.org/security/2011/dsa-2287 third party advisory vendor advisory
http://sourceforge.net/mailarchive/forum.php?thread_name=BANLkTikrnU6FJNQYFvwmt78hwpgKPVRd1Q%40mail.gmail.com&forum_name=png-mng-implement third party advisory issue tracking exploit
http://secunia.com/advisories/45405 third party advisory broken link
http://www.redhat.com/support/errata/RHSA-2011-1105.html vendor advisory broken link
http://www.openwall.com/lists/oss-security/2011/06/28/16 patch mailing list third party advisory
http://secunia.com/advisories/45460 third party advisory broken link
http://secunia.com/advisories/45486 third party advisory broken link
http://secunia.com/advisories/45492 third party advisory broken link
http://secunia.com/advisories/45415 third party advisory broken link

Frequently Asked Questions

What is the severity of CVE-2011-2501?
CVE-2011-2501 has been scored as a medium severity vulnerability.
How to fix CVE-2011-2501?
To fix CVE-2011-2501, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2011-2501 being actively exploited in the wild?
It is possible that CVE-2011-2501 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.