CVE-2011-3045: debian debian_linux Integer Overflow or Wraparound
CVSS: 8.8v3.1HighModified
AliasesRHSA-2012:0407DSA-2439-1
Published 22-03-2012Last modified 09-06-2025
Vulnerability summary
CVE-2011-3045 is a high (CVSS 8.8) Integer Overflow or Wraparound vulnerability in debian debian_linux. EPSS estimates a 3.53% chance of exploitation in the next 30 days, higher than 89.1% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
3.53%
0%100%
Low · -0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 22-03-2012PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
3.53%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
-0.03 pp
From 3.56% on 19-09-2026
19-09-202619-10-2026
EPSS score3.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- CWE-195Signed to Unsigned Conversion ErrorThe product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
Affected systems
Redhat12 products
- enterprise_linuxEOL5.0 | 6.0
- enterprise_linux_desktop5.0 | 6.0
- enterprise_linux_server_aus6.2
- enterprise_linux_server_eus6.2
- enterprise_linux_workstation5.0 | 6.0
Debian2 products
- libpng< 1.2.44-1+squeeze3
- debian_linuxEOL6.0
Fedoraproject1 product
- fedoraEOL15 | 16 | 17
Google1 product
- chrome< 17.0.963.83
Libpng1 product
- libpng< 1.5.10
Opensuse1 product
- opensuseEOL12.1
6 vendors · 18 products
References
31 links- lists.fedoraproject.org/pipermail/package-announce/2012-March/075981.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2012:033Vendor AdvisoryX Refsource MANDRIVANot Applicable
- lists.fedoraproject.org/pipermail/package-announce/2012-March/075424.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2012-March/075619.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2012-March/076461.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
Show all 31 references
- lists.fedoraproject.org/pipermail/package-announce/2012-March/075987.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14763VDB EntrySignatureX Refsource OVALThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=799000X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
- googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.htmlX Refsource CONFIRMRelease NotesVendor Advisory
- libpng.git.sourceforge.net/git/…X Refsource CONFIRM
- lists.opensuse.org/opensuse-updates/2012-03/msg00051.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2012-March/076731.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
