CVE-2011-2691: debian debian_linux NULL Pointer Dereference
Vulnerability summary
CVE-2011-2691 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 3.86% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 17-07-2011PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
3.86%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.86% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- debian_linuxEOL5.0 | 6.0
Fedoraproject1 product
- fedoraEOL14
Libpng1 product
- libpng≥ 1.0.0, < 1.0.55 | ≥ 1.2.0, < 1.2.45 | ≥ 1.4.0, < 1.4.8 | ≥ 1.5.0, < 1.5.4
3 vendors · 3 products
References
18 links- bugzilla.redhat.com/show_bug.cgi?id=720608X Refsource CONFIRMExploitIssue TrackingPatchThird Party Advisory
- libpng.git.sourceforge.net/git/…X Refsource CONFIRM
- www.mandriva.com/security/advisories?name=MDVSA-2011:151Vendor AdvisoryX Refsource MANDRIVABroken Link
- lists.fedoraproject.org/pipermail/package-announce/2011-July/063118.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
Show all 18 references
- lists.apple.com/archives/Security-announce/2011//Oct/msg00003.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- marc.info?l=bugtraq&m=133951357207000&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
