The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Java_jan2016_advisory | — | — | Aug 5, 2016 | Nov 24, 2015 |
| Aix 6.1 Java_jan2016_advisory | — | — | Aug 5, 2016 | Nov 24, 2015 |
| Aix 7.1 Java_jan2016_advisory | — | — | Aug 5, 2016 | Nov 24, 2015 |
| Aix 7.2 Java_jan2016_advisory | — | — | Aug 5, 2016 | Nov 24, 2015 |
| Centos_linux | — | Upgrade libpng-staticUpgrade libpngUpgrade libpng-devel | Dec 1, 2016 | Nov 24, 2015 |
| Debian | — | Upgrade libpng | Nov 24, 2015 | Nov 18, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 26, 2016 |
| Gentoo Linux | — | Upgrade media-libs/libpng. | Oct 30, 2017 | Nov 24, 2015 |
| Huawei Euleros 2_0_sp10 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Nov 11, 2024 | Nov 24, 2015 |
| Huawei Euleros 2_0_sp11 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Dec 12, 2024 | Nov 24, 2015 |
| Huawei Euleros 2_0_sp12 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Dec 12, 2024 | Nov 24, 2015 |
| Huawei Euleros 2_0_sp9 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Nov 11, 2024 | Nov 24, 2015 |
| Ibm Aix | — | Apply the fix or workaround for java_jan2016_advisory | Nov 30, 2017 | Nov 24, 2015 |
| Ibm Java | — | Upgrade IBM Java to version 7.1.3.30Upgrade IBM Java to version 6.0.16.20Upgrade IBM Java to version 7.0.9.30Upgrade IBM Java to version 6.1.8.20 | Oct 5, 2018 | Nov 24, 2015 |
| Oracle Solaris | — | Upgrade image/library/libpng to version 1.4.19-0.175.3.10.0.1.0 on Solaris 11.3 | May 29, 2017 | Nov 24, 2015 |
| Oracle_linux | — | Upgrade libpng12-develUpgrade libpng12Upgrade libpng-staticUpgrade libpngUpgrade libpng-devel | Oct 16, 2024 | Nov 24, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 22, 2015 |
| Suse | — | Upgrade libpng12-develUpgrade java-1_6_0-ibmUpgrade libpng12-compat-develUpgrade libpng12-0Upgrade libpng12-0-x86Upgrade java-1_7_1-ibm-pluginUpgrade libpng12-0-32bitUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_7_1-ibm-develUpgrade java-1_7_0-ibm-pluginUpgrade java-1_7_1-ibm-jdbcUpgrade java-1_7_0-ibm-develUpgrade java-1_7_1-ibmUpgrade libpng-develUpgrade java-1_6_0-ibm-pluginUpgrade java-1_7_0-ibm-alsaUpgrade libpng-devel-32bitUpgrade java-1_6_0-ibm-fontsUpgrade java-1_7_1-ibm-alsaUpgrade java-1_6_0-ibm-alsaUpgrade java-1_7_0-ibmUpgrade java-1_6_0-ibm-devel | Dec 18, 2015 | Nov 18, 2015 |
| Ubuntu | — | Upgrade libpng12-0 | Nov 24, 2015 | Nov 19, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub