Detections
Analytics
Scientific Linux Security Update : libpng on SL5.x i386/x86_64
medium Nessus Plugin ID 61100
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.A buffer overflow flaw was found in the way libpng processed certain PNG image files. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2011-2690)
Note: The application behavior required to exploit CVE-2011-2690 is rarely used. No application shipped with Scientific Linux behaves this way, for example.
An uninitialized memory read issue was found in the way libpng processed certain PNG images that use the Physical Scale (sCAL) extension. An attacker could create a specially crafted PNG image that, when opened, could cause an application using libpng to crash.
(CVE-2011-2692)
Users of libpng should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using libpng must be restarted for the update to take effect.
Solution
Update the affected libpng and / or libpng-devel packages.See Also
Plugin Details
Severity: Medium
ID: 61100
File Name: sl_20110728_libpng_on_SL5_x.nasl
Version: 1.6
Type: local
Agent: unix
Published: 8/1/2012
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 7/28/2011
Reference Information
CVE: CVE-2011-2690, CVE-2011-2692