The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libpng | Sep 20, 2017 | May 29, 2012 |
| Apple Osx Imageio | — | Upgrade macOS to the latest versionApply OS X security update 2012-004 | Sep 27, 2012 | May 29, 2012 |
| Apple Osx Note | — | Apply OS X security update 2012-004Upgrade macOS to the latest version | Aug 28, 2015 | May 29, 2012 |
| Apple Osx Php | — | Upgrade macOS to the latest versionApply OS X security update 2012-004 | Sep 27, 2012 | May 29, 2012 |
| Centos_linux | — | Upgrade libpng-staticUpgrade libpngUpgrade libpng-devel | Dec 1, 2016 | May 29, 2012 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Dec 19, 2014 |
| Freebsd | — | Upgrade pngUpgrade linux-f10-png | Dec 10, 2025 | Apr 8, 2012 |
| Gentoo Linux | — | Upgrade media-libs/libpng. | Oct 30, 2017 | May 29, 2012 |
| Huawei Euleros 2_0_sp10 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Nov 11, 2024 | May 29, 2012 |
| Huawei Euleros 2_0_sp11 | — | Upgrade syslinuxUpgrade syslinux-nonlinux | Dec 12, 2024 | May 29, 2012 |
| Huawei Euleros 2_0_sp12 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Dec 12, 2024 | May 29, 2012 |
| Huawei Euleros 2_0_sp9 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Nov 11, 2024 | May 29, 2012 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.1.0.0.24.2 on Solaris 11.1 | May 29, 2017 | May 29, 2012 |
| Oracle_linux | — | Upgrade libpng-develUpgrade libpng-staticUpgrade libpng | Oct 16, 2024 | May 29, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 29, 2012 |
| Suse | — | Upgrade libpng-devel-32bitUpgrade libpng12-0Upgrade libpng-develUpgrade libpng12-compat-develUpgrade libpng12-0-x86Upgrade libpng15-15Upgrade libpng12-develUpgrade libpng12-0-32bit | Jan 23, 2014 | Jan 23, 2014 |
| Ubuntu | — | Upgrade libpng12-0 | Nov 8, 2024 | May 29, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub