Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, might allow context-dependent attackers to execute arbitrary code via a "very wide interlaced" PNG image.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpng | Aug 30, 2017 | Jan 10, 2015 |
| Apple Osx Python | — | Apply OS X security update 2016-002Upgrade macOS to the latest version | Mar 29, 2016 | Jan 10, 2015 |
| Debian | — | Upgrade texlive-binUpgrade libpng1.6 | Jul 30, 2024 | Jan 10, 2015 |
| Gentoo Linux | — | Upgrade media-libs/libpng. | Oct 30, 2017 | Jan 10, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libpngUpgrade libpng-devel | Jun 17, 2020 | Jan 10, 2015 |
| Oracle Solaris | — | Upgrade image/library/libpng to version 1.4.11-0.175.2.13.0.3.0 on Solaris 11.2Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3 | May 29, 2017 | Jan 10, 2015 |
| Suse | — | Upgrade libpng12-develUpgrade libpng16-16-32bitUpgrade libpng16-16Upgrade libpng16-compat-develUpgrade libpng12-0Upgrade libpng16-devel | Dec 18, 2015 | Jan 10, 2015 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 10, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub