CVE-2011-3045— libpng ‘png_inflate()’ 缓冲区错误漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

n/a n/a

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

libpng是一个可对PNG图形文件实现创建、读写等操作的PNG参考库。 libpng中存在基于堆的缓冲区溢出漏洞。攻击者可利用该漏洞导致使用受影响库的应用程序崩溃，还可能在受影响应用程序上下文中运行任意代码。

CVE-2011-3045 影响 n/a n/a。尚无明确在野利用证据，仍需结合暴露面评估。libpng是一个可对PNG图形文件实现创建、读写等操作的PNG参考库。 libpng中存在基于堆的缓冲区溢出漏洞。攻击者可利用该漏洞导致使用受影响库的应用程序崩溃，还可能在受影响应用程序上下文中运行任意代码。 CVE-2011-3045 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2011-3045

一、 漏洞 CVE-2011-3045 基础信息

受影响产品

二、漏洞 CVE-2011-3045 的公开POC

三、漏洞 CVE-2011-3045 的情报信息

CVE-2011-3045 补丁与修复 (1)

• 🔗 Heap-buffer-overflow in wk_png_inflate [40054282] - Chromium 查看完整文章 x_refsource_CONFIRM

CVE-2011-3045 厂商安全公告 (14)

• https://bugzilla.redhat.com/show_bug.cgi?id=799000 x_refsource_CONFIRM
• http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html x_refsource_CONFIRM
• http://secunia.com/advisories/48512 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48554 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48485 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48320 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/49660 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1026823 vdb-entry x_refsource_SECTRACK
• http://www.debian.org/security/2012/dsa-2439 vendor-advisory x_refsource_DEBIAN
• http://rhn.redhat.com/errata/RHSA-2012-0407.html vendor-advisory x_refsource_REDHAT
• http://security.gentoo.org/glsa/glsa-201206-15.xml vendor-advisory x_refsource_GENTOO
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:033 vendor-advisory x_refsource_MANDRIVA
• http://rhn.redhat.com/errata/RHSA-2012-0488.html vendor-advisory x_refsource_REDHAT
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14763 vdb-entry signature x_refsource_OVAL

CVE-2011-3045 邮件列表归档 (8)

• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076461.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075619.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075424.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076731.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075981.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075987.html vendor-advisory x_refsource_FEDORA
• http://lists.opensuse.org/opensuse-updates/2012-03/msg00051.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html vendor-advisory x_refsource_SUSE

CVE-2011-3045 其他参考 (2)

• http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b x_refsource_CONFIRM
• http://src.chromium.org/viewvc/chrome?view=rev&revision=125311 x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2011-3045

同批安全公告 · n/a · 2012-03-22 · 共 22 条

显示前 20 条，共 22 条。 查看全部 → →

IV. Related Vulnerabilities

V. Comments for CVE-2011-3045