CVE-2011-2690: Canonical Ubuntu Linux

High severity, CVSS 8.8. EPSS: 3.3% chance of exploitation in the next 30 days.

Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.

Affected products

• Canonical Ubuntu Linux: version 8.04 only; version 10.04 only; version 10.10 only; version 11.04 only
• Debian Debian Linux: version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 14 only
• Libpng Libpng: from 1.0.0, before 1.0.55 (fixed in 1.0.55); from 1.2.0, before 1.2.45 (fixed in 1.2.45); from 1.4.0, before 1.4.8 (fixed in 1.4.8); from 1.5.0, before 1.5.4 (fixed in 1.5.4)

Published 2011-07-17. Last modified 2026-06-16.