PT-2012-1094 · Libpng+4 · Libpng+4
Jan Lieskovsky
·
Publicado
2012-03-20
·
Atualizado
2025-06-09
·
CVE-2011-3045
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libpng versions prior to 1.4.10beta01
libpng versions 1.2.10 and earlier
libpng versions 1.2.48 and earlier
libpng (affected versions not specified)
Description
The issue is related to an integer signedness error in the
png inflate function in pngrutil.c in libpng, which can be exploited remotely to cause a denial of service or possibly execute arbitrary code via a crafted PNG file. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely.Recommendations
For libpng versions prior to 1.4.10beta01, update to version 1.4.10beta01 or later.
For libpng versions 1.2.10 and earlier, update to a version later than 1.2.10.
For libpng versions 1.2.48 and earlier, update to a version later than 1.2.48.
For libpng with unspecified affected versions, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Integer Overflow
Memory Leak
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Google Chrome
Red Hat
Suse
Libpng