CVE-2011-3045 Integer overflow in n/a

High 8.8 Published 22 Mar 2012 Updated 9 Jun 2025

Remote attackers can cause application crashes or execute arbitrary code via crafted PNG files due to an integer signedness error in libpng.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2011-3045?

CVE-2011-3045 is a high-severity vulnerability in Debian Debian Linux, published on 22 Mar 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

Weakness: CWE-190, CWE-195

Which versions are affected by CVE-2011-3045?

It affects 13 products.

Linux distribution packages (24)

`libpng` Red Hat:enterprise_linux:5::client	All versions	`2:1.2.10-16.el5_8`
`libpng-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`2:1.2.10-16.el5_8`
`libpng` Red Hat:enterprise_linux:5::client_workstation	All versions	`2:1.2.10-16.el5_8`
`libpng-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`2:1.2.10-16.el5_8`
`libpng-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`2:1.2.10-16.el5_8`
`libpng` Red Hat:enterprise_linux:5::server	All versions	`2:1.2.10-16.el5_8`
`libpng-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`2:1.2.10-16.el5_8`
`libpng-devel` Red Hat:enterprise_linux:5::server	All versions	`2:1.2.10-16.el5_8`
`libpng` Red Hat:enterprise_linux:6::client	All versions	`2:1.2.48-1.el6_2`
`libpng-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`2:1.2.48-1.el6_2`
`libpng-devel` Red Hat:enterprise_linux:6::client	All versions	`2:1.2.48-1.el6_2`
`libpng-static` Red Hat:enterprise_linux:6::client	All versions	`2:1.2.48-1.el6_2`
`libpng` Red Hat:enterprise_linux:6::computenode	All versions	`2:1.2.48-1.el6_2`
`libpng-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`2:1.2.48-1.el6_2`
`libpng-devel` Red Hat:enterprise_linux:6::computenode	All versions	`2:1.2.48-1.el6_2`
`libpng-static` Red Hat:enterprise_linux:6::computenode	All versions	`2:1.2.48-1.el6_2`
`libpng` Red Hat:enterprise_linux:6::server	All versions	`2:1.2.48-1.el6_2`
`libpng-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`2:1.2.48-1.el6_2`
`libpng-devel` Red Hat:enterprise_linux:6::server	All versions	`2:1.2.48-1.el6_2`
`libpng-static` Red Hat:enterprise_linux:6::server	All versions	`2:1.2.48-1.el6_2`
`libpng` Red Hat:enterprise_linux:6::workstation	All versions	`2:1.2.48-1.el6_2`
`libpng-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`2:1.2.48-1.el6_2`
`libpng-devel` Red Hat:enterprise_linux:6::workstation	All versions	`2:1.2.48-1.el6_2`
`libpng-static` Red Hat:enterprise_linux:6::workstation	All versions	`2:1.2.48-1.el6_2`

Products include Debian Debian Linux, Fedoraproject Fedora, Google Chrome, Libpng Libpng, Opensuse Opensuse, Redhat Enterprise Linux and 7 more.

How do I fix CVE-2011-3045?

Upgrade to a fixed version.

Is CVE-2011-3045 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-3045 exists.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-41243, DSA-2439-1, GHSA-w4pv-vqp3-f753, RHSA-2012:0407.