Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Java_jan2016_advisory | — | — | Aug 5, 2016 | Nov 12, 2015 |
| Aix 6.1 Java_jan2016_advisory | — | — | Aug 5, 2016 | Nov 12, 2015 |
| Aix 7.1 Java_jan2016_advisory | — | — | Aug 5, 2016 | Nov 12, 2015 |
| Aix 7.2 Java_jan2016_advisory | — | — | Aug 5, 2016 | Nov 12, 2015 |
| Alpine Linux | — | Upgrade libpng | Aug 30, 2017 | Nov 12, 2015 |
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest versionApply OS X security update 2016-002 | Mar 29, 2016 | Nov 12, 2015 |
| Apple Osx Python | — | Apply OS X security update 2016-002Upgrade macOS to the latest version | Mar 29, 2016 | Nov 12, 2015 |
| Apple Osx Tcl | — | Apply OS X security update 2016-002Upgrade macOS to the latest version | Mar 29, 2016 | Nov 12, 2015 |
| Azul Zulu | — | Apply legacy security update: Azul Zulu JDK 7 installer 7.13 (JDK 7u95, quarterly CPU) — Azul Legacy Production SupportApply legacy security update: Azul Zulu JDK 6 installer 6.11 (JDK 6u77, quarterly CPU) — Azul Legacy Production SupportUpgrade to Azul Zulu JDK 8 installer 8.12 (JDK 8u71, quarterly CPU) (LTS stream) | Nov 13, 2015 | Nov 13, 2015 |
| Centos_linux | — | Upgrade libpngUpgrade libpng-staticUpgrade libpng-devel | Dec 1, 2016 | Nov 12, 2015 |
| Debian | — | Upgrade libpngUpgrade chromium-browser | Nov 23, 2015 | Nov 12, 2015 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Dec 19, 2015 |
| Freebsd | — | Upgrade png | Dec 10, 2025 | Nov 15, 2015 |
| Gentoo Linux | — | Upgrade media-libs/libpng.Upgrade www-client/chromium. | Oct 30, 2017 | Nov 12, 2015 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 9, 2022 | Mar 2, 2016 |
| Huawei Euleros 2_0_sp10 | — | Upgrade syslinuxUpgrade syslinux-nonlinux | Nov 11, 2024 | Nov 13, 2015 |
| Huawei Euleros 2_0_sp11 | — | Upgrade syslinuxUpgrade syslinux-nonlinux | Dec 12, 2024 | Nov 13, 2015 |
| Huawei Euleros 2_0_sp12 | — | Upgrade syslinuxUpgrade syslinux-nonlinux | Dec 12, 2024 | Nov 13, 2015 |
| Huawei Euleros 2_0_sp9 | — | Upgrade syslinux-nonlinuxUpgrade syslinux | Nov 11, 2024 | Nov 13, 2015 |
| Ibm Aix | — | Apply the fix or workaround for java_jan2016_advisory | Nov 30, 2017 | Nov 12, 2015 |
| Ibm Java | — | Upgrade IBM Java to version 6.0.16.20Upgrade IBM Java to version 7.1.3.30Upgrade IBM Java to version 7.0.9.30Upgrade IBM Java to version 8.0.2.10Upgrade IBM Java to version 6.1.8.20 | Oct 5, 2018 | Nov 13, 2015 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jan 19, 2016 | Nov 12, 2015 |
| Oracle Solaris | — | Upgrade image/library/libpng to version 1.4.19-0.175.3.10.0.1.0 on Solaris 11.3Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | May 29, 2017 | Nov 12, 2015 |
| Oracle_linux | — | Upgrade libpngUpgrade libpng-develUpgrade libpng-staticUpgrade libpng12Upgrade libpng12-devel | Oct 16, 2024 | Nov 13, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 12, 2015 |
| Suse | — | Upgrade java-1_8_0-ibm-pluginUpgrade java-1_6_0-ibm-alsaUpgrade java-1_7_1-ibm-pluginUpgrade java-1_7_1-ibm-develUpgrade java-1_7_0-openjdk-develUpgrade java-1_7_0-ibmUpgrade java-1_7_0-ibm-develUpgrade java-1_6_0-ibm-fontsUpgrade java-1_6_0-ibm-jdbcUpgrade libpng12-0-x86Upgrade libpng16-16-32bitUpgrade java-1_7_0-openjdk-demoUpgrade java-1_7_0-openjdkUpgrade java-1_6_0-ibm-pluginUpgrade java-1_8_0-ibmUpgrade java-1_8_0-openjdk-develUpgrade libpng12-0-32bitUpgrade java-1_7_0-ibm-alsaUpgrade java-1_7_0-ibm-pluginUpgrade libpng12-develUpgrade java-1_7_1-ibmUpgrade java-1_8_0-ibm-develUpgrade java-1_8_0-openjdkUpgrade libpng16-16Upgrade java-1_7_0-openjdk-headlessUpgrade java-1_7_0-ibm-jdbcUpgrade libpng12-compat-develUpgrade java-1_8_0-openjdk-demoUpgrade java-1_6_0-ibm-develUpgrade java-1_7_1-ibm-jdbcUpgrade libpng-devel-32bitUpgrade libpng15-15Upgrade libpng16-compat-develUpgrade libpng16-develUpgrade java-1_8_0-openjdk-headlessUpgrade libpng12-0Upgrade java-1_8_0-ibm-alsaUpgrade java-1_7_1-ibm-alsaUpgrade java-1_6_0-ibmUpgrade libpng-develUpgrade chromium | Dec 18, 2015 | Nov 12, 2015 |
| Ubuntu | — | Upgrade libpng12-0 | Nov 23, 2015 | Nov 12, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub