CVE-2011-2691
published 2011-07-17CVE-2011-2691: The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a…
PriorityP426medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
3.86%
89.1th percentile
The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| libpng | libpng | >= 1.0.0 < 1.0.55 | 1.0.55 |
| libpng | libpng | >= 1.2.0 < 1.2.45 | 1.2.45 |
| libpng | libpng | >= 1.4.0 < 1.4.8 | 1.4.8 |
| libpng | libpng | >= 1.5.0 < 1.5.4 | 1.5.4 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
libpng: Crash in png_default_error due to use of NULL Pointer
vendor_redhat·2011-07-07·CVSS 6.5
CVE-2011-2691 [MEDIUM] libpng: Crash in png_default_error due to use of NULL Pointer
libpng: Crash in png_default_error due to use of NULL Pointer
The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
Statement: Not vulnerable. This issue did not affect the versions of libpng as
shipped with Red Hat Enterprise Linux 4, 5, or 6.
Package: libpng (Red Hat Enterprise Linux 4) - Not affected
Package: libpng (Red Hat Enterprise Linux 5) - Not affected
Package: libpng (Red Hat Enterprise Linux 6) - Not affected
Red Hat
php: extract() can overwrite $GLOBALS and $this when using EXTR_OVERWRITE
vendor_redhat·2010-12-08·CVSS 7.5
CVE-2011-0752 [HIGH] php: extract() can overwrite $GLOBALS and $this when using EXTR_OVERWRITE
php: extract() can overwrite $GLOBALS and $this when using EXTR_OVERWRITE
The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
Statement: We do not consider this flaw to be a security issue as it is only exploitable by the script author. No trust boundary is crossed.
This issue did not affect the versions of PHP as shipped with Red Hat Enterprise Linux 3, 4, or 5 (php). This issue was addressed in the php53 packages as shipped in Red Hat Enterprise Linux 5 before t
GHSA
GHSA-vprr-5687-f565: The png_err function in pngerror
ghsa_unreviewed·2022-05-13
CVE-2011-2691 [MEDIUM] CWE-476 GHSA-vprr-5687-f565: The png_err function in pngerror
The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-2690 CVE-2011-2692 libpng various flaws [fedora-all]
bugzilla·2011-07-14·CVSS 8.8
CVE-2011-2690 [HIGH] CVE-2011-2690 CVE-2011-2692 libpng various flaws [fedora-all]
CVE-2011-2690 CVE-2011-2692 libpng various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=720607
Please note: this issue affects multiple supported ve
Bugzilla
CVE-2011-2691 libpng: Crash in png_default_error due to use of NULL Pointer
bugzilla·2011-07-12·CVSS 6.5
CVE-2011-2691 [MEDIUM] CVE-2011-2691 libpng: Crash in png_default_error due to use of NULL Pointer
CVE-2011-2691 libpng: Crash in png_default_error due to use of NULL Pointer
It was found that in libpng, prior to 1.2.45, the error function
received a NULL pointer, expressed erroneously as '\0', instead of
the empty string "". This error was introduced in libpng-1.2.20,
and png_default_error() will crash in this case.
This was be fixed in libpng-1.5.4, libpng-1.4.8, libpng-1.2.45,
and libpng-1.0.55.
Patch:
http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commitdiff;h=9dad5e37aef295b4ef8dea39392b652deebc9261
Discussion:
This has been assigned CVE-2011-2691
---
Created libpng tracking bugs for this issue
Affects: fedora-all [bug 721307]
---
Hmmm .... now that I look more closely, the erroneous code for this is compiled only if PNG_NO_ERROR_TEXT is defined, which
Bugzilla
CVE-2011-2501 libpng: regression of CVE-2004-0421 in 1.2.23+ [fedora-all]
bugzilla·2011-06-29·CVSS 5.0
CVE-2011-2501 [MEDIUM] CVE-2011-2501 libpng: regression of CVE-2004-0421 in 1.2.23+ [fedora-all]
CVE-2011-2501 libpng: regression of CVE-2004-0421 in 1.2.23+ [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=717084
Please note: this issue affects multiple
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
arxiv_fulltext·2022-12-29
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
## Abstract
Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will influence the security of IoT firmware. Existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement , which leverages syntactical features and control-flow graph features to detect the TPCs in firmware, and then recognizes the corresponding vulnerabilities. Based on , we present the first l
http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=9dad5e37aef295b4ef8dea39392b652deebc9261http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.htmlhttp://marc.info/?l=bugtraq&m=133951357207000&w=2http://secunia.com/advisories/45046http://secunia.com/advisories/45405http://secunia.com/advisories/45492http://secunia.com/advisories/49660http://security.gentoo.org/glsa/glsa-201206-15.xmlhttp://support.apple.com/kb/HT5002http://www.debian.org/security/2011/dsa-2287http://www.libpng.org/pub/png/libpng.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:151http://www.openwall.com/lists/oss-security/2011/07/13/2http://www.securityfocus.com/bid/48660https://bugzilla.redhat.com/show_bug.cgi?id=720608https://exchange.xforce.ibmcloud.com/vulnerabilities/68537http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=9dad5e37aef295b4ef8dea39392b652deebc9261http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.htmlhttp://marc.info/?l=bugtraq&m=133951357207000&w=2http://secunia.com/advisories/45046http://secunia.com/advisories/45405http://secunia.com/advisories/45492http://secunia.com/advisories/49660http://security.gentoo.org/glsa/glsa-201206-15.xmlhttp://support.apple.com/kb/HT5002http://www.debian.org/security/2011/dsa-2287http://www.libpng.org/pub/png/libpng.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2011:151http://www.openwall.com/lists/oss-security/2011/07/13/2http://www.securityfocus.com/bid/48660https://bugzilla.redhat.com/show_bug.cgi?id=720608https://exchange.xforce.ibmcloud.com/vulnerabilities/68537
2011-07-17
Published