CVE-2019-7317

Name
CVE-2019-7317
Description
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Exploit https://github.com/glennrp/libpng/issues/275
Mailing List https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803
Mailing List https://seclists.org/bugtraq/2019/Apr/30
VDB Entry http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html
Third Party Advisory https://www.debian.org/security/2019/dsa-4435
Mailing List https://seclists.org/bugtraq/2019/Apr/36
Third Party Advisory https://usn.ubuntu.com/3962-1/
UBUNTU https://usn.ubuntu.com/3991-1/
BUGTRAQ https://seclists.org/bugtraq/2019/May/56
BUGTRAQ https://seclists.org/bugtraq/2019/May/59
DEBIAN https://www.debian.org/security/2019/dsa-4448
MLIST https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html
REDHAT https://access.redhat.com/errata/RHSA-2019:1265
REDHAT https://access.redhat.com/errata/RHSA-2019:1269
REDHAT https://access.redhat.com/errata/RHSA-2019:1267
DEBIAN https://www.debian.org/security/2019/dsa-4451
BUGTRAQ https://seclists.org/bugtraq/2019/May/67
MLIST https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html
UBUNTU https://usn.ubuntu.com/3997-1/
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html
REDHAT https://access.redhat.com/errata/RHSA-2019:1310
REDHAT https://access.redhat.com/errata/RHSA-2019:1309
REDHAT https://access.redhat.com/errata/RHSA-2019:1308
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html
BID http://www.securityfocus.com/bid/108098
CONFIRM https://security.netapp.com/advisory/ntap-20190719-0005/
MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
UBUNTU https://usn.ubuntu.com/4080-1/
UBUNTU https://usn.ubuntu.com/4083-1/
GENTOO https://security.gentoo.org/glsa/201908-02
REDHAT https://access.redhat.com/errata/RHSA-2019:2494
REDHAT https://access.redhat.com/errata/RHSA-2019:2495
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html
REDHAT https://access.redhat.com/errata/RHSA-2019:2585
REDHAT https://access.redhat.com/errata/RHSA-2019:2590
REDHAT https://access.redhat.com/errata/RHSA-2019:2592
REDHAT https://access.redhat.com/errata/RHSA-2019:2737
CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us
MISC https://www.oracle.com/security-alerts/cpuApr2021.html
MISC https://www.oracle.com/security-alerts/cpuoct2021.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:libpng:libpng:1.6.36:*:*:*:*:*:*:* libpng == None == 1.6.36

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openjdk11 edge-community 11.0.4_p11-r0 None fixed
openjdk11 3.22-community 11.0.4_p11-r0 None fixed
openjdk11 3.21-community 11.0.4_p11-r0 None fixed
openjdk11 3.20-community 11.0.4_p11-r0 None fixed
openjdk11 3.19-community 11.0.4_p11-r0 None fixed
openjdk11 3.18-community 11.0.4_p11-r0 None fixed
openjdk11 3.17-community 11.0.4_p11-r0 None fixed
openjdk8 edge-community 8.222.10-r0 None fixed
openjdk8 3.22-community 8.222.10-r0 None fixed
openjdk8 3.21-community 8.222.10-r0 None fixed
openjdk8 3.20-community 8.222.10-r0 None fixed
openjdk8 3.19-community 8.222.10-r0 None fixed
openjdk8 3.18-community 8.222.10-r0 None fixed
openjdk8 3.17-community 8.222.10-r0 None fixed
libpng edge-main 1.6.37-r0 None fixed
libpng 3.22-main 1.6.37-r0 None fixed
libpng 3.21-main 1.6.37-r0 None fixed
libpng 3.20-main 1.6.37-r0 None fixed
libpng 3.19-main 1.6.37-r0 None fixed
libpng 3.18-main 1.6.37-r0 None fixed
libpng 3.17-main 1.6.37-r0 None fixed
libpng 3.12-main 1.6.37-r0 None fixed
libpng 3.11-main 1.6.37-r0 None fixed
libpng 3.10-main 1.6.37-r0 None fixed
firefox-esr edge-community 60.7.0-r0 None fixed
firefox-esr 3.22-community 60.7.0-r0 None fixed
firefox-esr 3.21-community 60.7.0-r0 None fixed
firefox-esr 3.20-community 60.7.0-r0 None fixed
firefox-esr 3.19-community 60.7.0-r0 None fixed
firefox-esr 3.18-community 60.7.0-r0 None fixed
firefox-esr 3.17-community 60.7.0-r0 None fixed