CVE-2011-3045

high-risk
Published 2012-03-22

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

Do I need to act?

~
4.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (18)

Affected Vendors

Redhat Fedoraproject Google Opensuse Libpng Debian

References (50)

Vendor Advisory http://code.google.com/p/chromium/issues/detail?id=116162
Release Notes http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html
http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=...
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075424.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075619.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075981.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075987.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076461.html
Mailing List http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076731.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html
Mailing List http://lists.opensuse.org/opensuse-updates/2012-03/msg00051.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2012-0407.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2012-0488.html
Not Applicable http://secunia.com/advisories/48320
Not Applicable http://secunia.com/advisories/48485
Not Applicable http://secunia.com/advisories/48512
Not Applicable http://secunia.com/advisories/48554
Not Applicable http://secunia.com/advisories/49660
Third Party Advisory http://security.gentoo.org/glsa/glsa-201206-15.xml
Patch http://src.chromium.org/viewvc/chrome?view=rev&revision=125311
and 30 more references
57
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 8/34 · Low
Exposure 19/34 · Moderate