What’s Vulnerable › Vulnerabilities

CVE-2011-3045

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-03-22 · updated 2026-06-16
• Weakness: CWE-190

Description

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

Affected products

• Debian Linux: 6.0
• Fedoraproject Fedora: 15, 16, 17
• Google Chrome: before 17.0.963.83 — fixed in 17.0.963.83
• pnggroup libpng: before 1.5.10 — fixed in 1.5.10
• Opensuse: 12.1
• Red Hat Enterprise Linux: 5.0, 6.0
• RedHat Enterprise Linux Desktop: 5.0, 6.0
• RedHat Enterprise Linux Server Aus: 6.2
• RedHat Enterprise Linux Server Eus: 6.2
• RedHat Enterprise Linux Workstation: 5.0, 6.0
• Red Hat, Inc. Gluster Storage for RHEL 6: 2.0
• RedHat Storage: 2.0
• RedHat Storage For Public Cloud: 2.0

How to fix

Upgrade to a fixed version: Google Chrome 17.0.963.83; pnggroup libpng 1.5.10. Check the vendor advisory for mitigations.

References

• http://code.google.com/p/chromium/issues/detail?id=116162
• http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html
• http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075424.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075619.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075981.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075987.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076461.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076731.html
• http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html
• http://lists.opensuse.org/opensuse-updates/2012-03/msg00051.html
• http://rhn.redhat.com/errata/RHSA-2012-0407.html

Get alerted when CVE-2011-3045 or the next vulnerability affects your stack