CVE-2011-2691: Debian Linux

Medium severity, CVSS 6.5. EPSS: 3.9% chance of exploitation in the next 30 days.

The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.

Affected products

• Debian Debian Linux: version 5.0 only; version 6.0 only
• Fedoraproject Fedora: version 14 only
• Libpng Libpng: from 1.0.0, before 1.0.55 (fixed in 1.0.55); from 1.2.0, before 1.2.45 (fixed in 1.2.45); from 1.4.0, before 1.4.8 (fixed in 1.4.8); from 1.5.0, before 1.5.4 (fixed in 1.5.4)

Published 2011-07-17. Last modified 2026-06-16.