This update fixes a 1-byte uninitialized memory reference in png_format_buffer(). It allows attackers to cause a denial of service (crash) via a malformed PNG image file that triggers an error that causes an out-of-bounds read when creating the error message. This is CVE-2011-2501.

Also fixed in this release are some other minor security problems and there's additionally a bugfix backported from 1.5.3: when expanding a paletted image, always expand to RGBA if transparency is present.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Frank Busse discovered that libpng did not properly handle certain malformed PNG images. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause libpng to crash, resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS, 10.10, and 11.04. (CVE-2011-2501)

It was discovered that libpng did not properly handle certain malformed PNG images. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-2690)

Frank Busse discovered that libpng did not properly handle certain PNG images with invalid sCAL chunks. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2011-2692).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of libpng fixes :

  - CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C):
    Resource Management Errors (CWE-399). (CVE-2008-6218)

  - CVSS v2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P):
    Buffer Errors (CWE-119). (CVE-2011-2690)

  - CVSS v2 Base Score: 5.0 (AV:N/AC:M/Au:N/C:N/I:N/A:P):
    Buffer Errors (CWE-119). (CVE-2011-2692)

This update of libpng12-0 fixes :

  - CVE-2008-6218: CVSS v2 Base Score: 7.1     (AV:N/AC:M/Au:N/C:N/I:N/A:C): Resource Management Errors     (CWE-399)

  - unknown (unknown). (CVE-2009-5063: CVSS v2 Base Score:
    4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P))

  - CVE-2011-2501: CVSS v2 Base Score: 5.0     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Design Error     (CWE-DesignError)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2691: CVSS v2 Base Score: 4.3     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Other (CWE-Other)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

This update of libpng fixes :

  - CVE-2008-6218: CVSS v2 Base Score: 7.1     (AV:N/AC:M/Au:N/C:N/I:N/A:C): Resource Management Errors     (CWE-399)

  - CVE-2011-2690: CVSS v2 Base Score: 5.1     (AV:N/AC:H/Au:N/C:P/I:P/A:P): Buffer Errors (CWE-119)

  - CVE-2011-2692: CVSS v2 Base Score: 5.0     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

The remote host is affected by the vulnerability described in GLSA-201206-15 (libpng: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libpng:
      The &ldquo;embedded_profile_len()&rdquo; function in pngwutil.c does not         check for negative values, resulting in a memory leak (CVE-2009-5063).
      The &ldquo;png_format_buffer()&rdquo; function in pngerror.c contains an         off-by-one error (CVE-2011-2501).
      The &ldquo;png_rgb_to_gray()&rdquo; function in pngrtran.c contains an         integer overflow error (CVE-2011-2690).
      The &ldquo;png_err()&rdquo; function in pngerror.c contains a NULL pointer         dereference error (CVE-2011-2691).
      The &ldquo;png_handle_sCAL()&rdquo; function in pngrutil.c improperly handles         malformed sCAL chunks(CVE-2011-2692).
      The &ldquo;png_decompress_chunk()&rdquo; function in pngrutil.c contains an         integer overflow error (CVE-2011-3026).
      The &ldquo;png_inflate()&rdquo; function in pngrutil.c contains and out of         bounds error (CVE-2011-3045).
      The &ldquo;png_set_text_2()&rdquo; function in pngset.c contains an error         which could result in memory corruption (CVE-2011-3048).
      The &ldquo;png_formatted_warning()&rdquo; function in pngerror.c contains an         off-by-one error (CVE-2011-3464).
  Impact :

    An attacker could exploit these vulnerabilities to execute arbitrary       code with the permissions of the user running the vulnerable program,       which could be the root user, or to cause programs linked against the       library to crash.
  Workaround :

    There is no known workaround at this time.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1424 advisory.

    This advisory aggregates security fixes for the libpng SRPM in CIQ LTS 9.2. It addresses 31 CVEs:
    CVE-2025-64720, CVE-2025-65018, CVE-2025-66293, CVE-2026-34757, CVE-2025-64505, and 26 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1395 advisory.

    This advisory aggregates security fixes for the libpng SRPM in CIQ LTS 9.6. It addresses 21 CVEs:
    CVE-2025-64506, CVE-2019-7317, CVE-2007-2445, CVE-2007-5269, CVE-2008-1382, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
55655	Fedora 14 : libpng10-1.0.55-1.fc14 (2011-8867)	Nessus	Fedora Local Security Checks	2011/7/25	2021/1/11	medium
55699	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : libpng vulnerabilities (USN-1175-1)	Nessus	Ubuntu Local Security Checks	2011/7/27	2019/9/19	medium
55895	SuSE9 Security Update : libpng (YOU Patch Number 12815)	Nessus	SuSE Local Security Checks	2011/8/18	2021/1/14	high
55896	SuSE 11.1 Security Update : libpng (SAT Patch Number 4948)	Nessus	SuSE Local Security Checks	2011/8/18	2021/1/19	high
57218	SuSE 10 Security Update : libpng (ZYPP Patch Number 7670)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	high
59668	GLSA-201206-15 : libpng: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/6/25	2021/1/6	high
356085	Rocky Linux 9.2 [CIQ] Security Update: libpng / libpng-devel Multiple Vulnerabilities (ciqsa-2026_1424)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	high
357096	Rocky Linux 9.6 [CIQ] Security Update: libpng / libpng-devel Multiple Vulnerabilities (ciqsa-2026_1395)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

検出

プラグインの検索

medium

medium

high

high

high

high

high

critical