CVE-2011-2501: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 3.5% chance of exploitation in the next 30 days.

The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data. NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.

Affected products

• Canonical Ubuntu Linux: version 8.04 only; version 10.04 only; version 10.10 only; version 11.04 only
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 14 only
• Libpng Libpng: from 1.0.0, before 1.0.55 (fixed in 1.0.55); from 1.2.0, before 1.2.45 (fixed in 1.2.45); from 1.4.0, before 1.4.8 (fixed in 1.4.8); from 1.5.0, before 1.5.4 (fixed in 1.5.4)

Published 2011-07-17. Last modified 2026-06-16.