What’s Vulnerable › Vulnerabilities

CVE-2011-3026

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 72.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2012-02-16 · updated 2026-06-16
• Weakness: CWE-190

Description

Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation.

Affected products

• Apple Iphone Os: before 6.0 — fixed in 6.0
• macOS: from 10.7.0 before 10.7.5; 10.6.8 — fixed in 10.7.5
• Apple Mac Os X Server: from 10.7.0 before 10.7.5; 10.6.8 — fixed in 10.7.5
• Google Chrome: before 17.0.963.56 — fixed in 17.0.963.56
• Opensuse: 11.4
• SUSE Linux Enterprise Server: 11-sp1
• SUSE Linux Enterprise: 11-sp1

How to fix

Upgrade to a fixed version: Apple Iphone Os 6.0; macOS 10.7.5; Apple Mac Os X Server 10.7.5; Google Chrome 17.0.963.56. Check the vendor advisory for mitigations.

References

• http://code.google.com/p/chromium/issues/detail?id=112822
• http://googlechromereleases.blogspot.com/2012/02/chrome-stable-update.html
• http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html
• http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00023.html
• http://secunia.com/advisories/48016
• http://secunia.com/advisories/48110
• http://secunia.com/advisories/49660
• http://security.gentoo.org/glsa/glsa-201206-15.xml
• http://support.apple.com/kb/HT5501
• http://support.apple.com/kb/HT5503

Get alerted when CVE-2011-3026 or the next vulnerability affects your stack