Overview
Libpng-1.5.0 introduced a vulnerability in the rgb-to-gray transform function.
Description
Libpng based applications that call the png_set_rgb_to_gray() function from pngrtran.c are vulnerable. Libpng versions prior to 1.5.0 are not vulnerable. |
Impact
An attacker may cause the application to crash or execute arbitrary code as the user. |
Solution
Apply an Update Upgrade to version 1.5.1. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- http://sourceforge.net/mailarchive/forum.php?thread_name=002b01cbb0e2%24ae636c80%240b2a4580%24%40acm.org&forum_name=png-mng-implement
- http://libpng.sourceforge.net/
- ftp://ftp.simplesystems.org/pub/png-group/src/libpng-1.5.1beta01-1.5.0-diff.txt
- ftp://ftp.simplesystems.org/pub/png-group/src/libpng-1.5.1beta01-README.txt
Acknowledgements
Thanks to Glenn Randers-Pehrson for reporting this vulnerability.
This document was written by Jared Allar.
Other Information
| CVE IDs: | CVE-2011-0408 |
| Date Public: | 2011-01-08 |
| Date First Published: | 2011-01-11 |
| Date Last Updated: | 2011-02-03 19:23 UTC |
| Document Revision: | 19 |