Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Debian
  • Debian Linux
Fedoraproject
  • Fedora
Google
  • Chrome
Libpng
  • Libpng
Opensuse
  • Opensuse
Redhat
  • Enterprise Linux
  • Enterprise Linux Desktop
  • Enterprise Linux Server Aus
  • Enterprise Linux Server Eus
  • Enterprise Linux Workstation
  • Gluster Storage
  • Storage
  • Storage For Public Cloud

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:redhat:gluster_storage:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Configuration 3 [-]

cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 5
libpng-2:1.2.10-16.el5_8 cpe:/o:redhat:enterprise_linux:5 RHSA-2012:0407 2012-03-20T00:00:00Z
Red Hat Enterprise Linux 6
libpng-2:1.2.48-1.el6_2 cpe:/o:redhat:enterprise_linux:6 RHSA-2012:0407 2012-03-20T00:00:00Z
References
Link Providers
http://code.google.com/p/chromium/issues/detail?id=116162 cve-icon cve-icon
http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html cve-icon cve-icon
http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075424.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075619.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075981.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075987.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076461.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076731.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2012-03/msg00051.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2012-0407.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2012-0488.html cve-icon cve-icon
http://secunia.com/advisories/48320 cve-icon cve-icon
http://secunia.com/advisories/48485 cve-icon cve-icon
http://secunia.com/advisories/48512 cve-icon cve-icon
http://secunia.com/advisories/48554 cve-icon cve-icon
http://secunia.com/advisories/49660 cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-201206-15.xml cve-icon cve-icon
http://src.chromium.org/viewvc/chrome?view=rev&revision=125311 cve-icon cve-icon
http://www.debian.org/security/2012/dsa-2439 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2012:033 cve-icon cve-icon
http://www.securitytracker.com/id?1026823 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=799000 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2011-3045 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14763 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2011-3045 cve-icon
History

Mon, 09 Jun 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-195
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2012-03-22T16:00:00.000Z

Updated: 2025-06-09T15:35:52.219Z

Reserved: 2011-08-09T00:00:00.000Z

Link: CVE-2011-3045

cve-icon Vulnrichment

Updated: 2024-08-06T23:22:27.386Z

cve-icon NVD

Status : Deferred

Published: 2012-03-22T16:55:01.160

Modified: 2025-06-09T16:15:22.810

Link: CVE-2011-3045

cve-icon Redhat

Severity : Moderate

Publid Date: 2012-03-08T00:00:00Z

Links: CVE-2011-3045 - Bugzilla