MEDIUM
libpng: use-after-free in png_image_free in png.c
Published Feb 4, 2019
5.3
MEDIUMCVSS 3.1
EPSS 9.39%
Description
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Affected products
No data.
Configuration 2
OR
- 8.0
- 9.0
Configuration 3
OR
- 16.04
- 16.04
- 18.04
- 18.10
- 19.04
Configuration 4
Configuration 5
OR
- < 8.7.0-00
- < 8.7.0-00
Configuration 6
OR
- n/a
- n/a
Configuration 8
AND
- n/a
Running on/with
- 12.0
Configuration 9
OR
- < 9.6
- < 9.6
- 9.6
- 9.6
- n/a
- n/a
- < 11.53
- < 3.2
- < 4.0
- < 7.3.9
- < 5.1
- n/a
- < 3.4.2
- < 3.4.2
- 3.4.2
- 3.4.2
- n/a
Configuration 10
OR
- 5.8
- 6.0
- 7.0
- 8.0
- 6.0
- 7.0
- 6.0
- 7.0
- 8.0
- 6.0
- 7.0
- 7.0
- 8.0
- 6.0
- 7.0
- 6.0
- 7.0
No data.
Red Hat Enterprise Linux 6
firefox-0:60.7.0-1.el6_10
Fixed · RHSA-2019:1267
Red Hat Enterprise Linux 6
thunderbird-0:60.7.0-1.el6_10
Fixed · RHSA-2019:1310
Red Hat Enterprise Linux 6 Supplementary
java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10
Fixed · RHSA-2019:2494
Red Hat Enterprise Linux 6 Supplementary
java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10
Fixed · RHSA-2019:2592
Red Hat Enterprise Linux 7
firefox-0:60.7.0-1.el7_6
Fixed · RHSA-2019:1265
Red Hat Enterprise Linux 7
thunderbird-0:60.7.0-1.el7_6
Fixed · RHSA-2019:1309
Red Hat Enterprise Linux 7 Supplementary
java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7
Fixed · RHSA-2019:2495
Red Hat Enterprise Linux 7 Supplementary
java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7
Fixed · RHSA-2019:2585
Red Hat Enterprise Linux 8
firefox-0:60.7.0-1.el8_0
Fixed · RHSA-2019:1269
Red Hat Enterprise Linux 8
java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0
Fixed · RHSA-2019:2590
Red Hat Enterprise Linux 8
thunderbird-0:60.7.0-1.el8_0
Fixed · RHSA-2019:1308
Red Hat Satellite 5.8
java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10
Fixed · RHSA-2019:2737
Red Hat Enterprise Linux 5
libpng
Not affected
Red Hat Enterprise Linux 6
libpng
Not affected
Red Hat Enterprise Linux 7
libpng
Not affected
Red Hat Enterprise Linux 7
libpng12
Not affected
Red Hat Enterprise Linux 8
libpng
Fix deferred
Red Hat Enterprise Linux 8
libpng12
Not affected
Red Hat Enterprise Linux 8
mingw-libpng
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | firefox-0:60.7.0-1.el6_10 | Fixed | RHSA-2019:1267 |
| Red Hat Enterprise Linux 6 | thunderbird-0:60.7.0-1.el6_10 | Fixed | RHSA-2019:1310 |
| Red Hat Enterprise Linux 6 Supplementary | java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10 | Fixed | RHSA-2019:2494 |
| Red Hat Enterprise Linux 6 Supplementary | java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10 | Fixed | RHSA-2019:2592 |
| Red Hat Enterprise Linux 7 | firefox-0:60.7.0-1.el7_6 | Fixed | RHSA-2019:1265 |
| Red Hat Enterprise Linux 7 | thunderbird-0:60.7.0-1.el7_6 | Fixed | RHSA-2019:1309 |
| Red Hat Enterprise Linux 7 Supplementary | java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7 | Fixed | RHSA-2019:2495 |
| Red Hat Enterprise Linux 7 Supplementary | java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7 | Fixed | RHSA-2019:2585 |
| Red Hat Enterprise Linux 8 | firefox-0:60.7.0-1.el8_0 | Fixed | RHSA-2019:1269 |
| Red Hat Enterprise Linux 8 | java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0 | Fixed | RHSA-2019:2590 |
| Red Hat Enterprise Linux 8 | thunderbird-0:60.7.0-1.el8_0 | Fixed | RHSA-2019:1308 |
| Red Hat Satellite 5.8 | java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10 | Fixed | RHSA-2019:2737 |
| Red Hat Enterprise Linux 5 | libpng | Not affected | n/a |
| Red Hat Enterprise Linux 6 | libpng | Not affected | n/a |
| Red Hat Enterprise Linux 7 | libpng | Not affected | n/a |
| Red Hat Enterprise Linux 7 | libpng12 | Not affected | n/a |
| Red Hat Enterprise Linux 8 | libpng | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | libpng12 | Not affected | n/a |
| Red Hat Enterprise Linux 8 | mingw-libpng | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.
References (47)
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html vendor-advisoryx_refsource_SUSEThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html x_refsource_MISCThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/108098 vdb-entryx_refsource_BIDNot ApplicableThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2019:1265 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1267 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1269 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1308 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1309 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1310 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2494 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2495 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2585 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2590 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2592 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2737 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2019-7317 Vendor Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803 x_refsource_MISCIssue TrackingMailing ListThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1672409 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-16860 Advisory
- https://github.com/glennrp/libpng/issues/275 x_refsource_MISCExploitIssue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-7317
- https://seclists.org/bugtraq/2019/Apr/30 mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/Apr/36 mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/May/56 mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/May/59 mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2019/May/67 mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/201908-02 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://security.netapp.com/advisory/ntap-20190719-0005/ x_refsource_CONFIRMThird Party Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us x_refsource_CONFIRMThird Party Advisory
- https://usn.ubuntu.com/3962-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3991-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/3997-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/4080-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/4083-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-7317
- https://www.debian.org/security/2019/dsa-4435 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.debian.org/security/2019/dsa-4448 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.debian.org/security/2019/dsa-4451 vendor-advisoryx_refsource_DEBIANThird Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISCThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISCThird Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISCPatchThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html | vendor-advisoryx_refsource_SUSEThird Party Advisory | |
| http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html | vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory | |
| http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html | vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory | |
| http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html | vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory | |
| http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html | vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory | |
| http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html | x_refsource_MISCThird Party AdvisoryVDB Entry | |
| http://www.securityfocus.com/bid/108098 | vdb-entryx_refsource_BIDNot ApplicableThird Party AdvisoryVDB Entry | |
| https://access.redhat.com/errata/RHSA-2019:1265 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:1267 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:1269 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:1308 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:1309 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:1310 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:2494 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:2495 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:2585 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:2590 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:2592 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/errata/RHSA-2019:2737 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/security/cve/CVE-2019-7317 | Vendor Advisory | |
| https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803 | x_refsource_MISCIssue TrackingMailing ListThird Party Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1672409 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-16860 | Advisory | |
| https://github.com/glennrp/libpng/issues/275 | x_refsource_MISCExploitIssue TrackingThird Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html | mailing-listx_refsource_MLISTMailing ListThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-7317 | ||
| https://seclists.org/bugtraq/2019/Apr/30 | mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory | |
| https://seclists.org/bugtraq/2019/Apr/36 | mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory | |
| https://seclists.org/bugtraq/2019/May/56 | mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory | |
| https://seclists.org/bugtraq/2019/May/59 | mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory | |
| https://seclists.org/bugtraq/2019/May/67 | mailing-listx_refsource_BUGTRAQIssue TrackingMailing ListThird Party Advisory | |
| https://security.gentoo.org/glsa/201908-02 | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| https://security.netapp.com/advisory/ntap-20190719-0005/ | x_refsource_CONFIRMThird Party Advisory | |
| https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us | x_refsource_CONFIRMThird Party Advisory | |
| https://usn.ubuntu.com/3962-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/3991-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/3997-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/4080-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://usn.ubuntu.com/4083-1/ | vendor-advisoryx_refsource_UBUNTUThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-7317 | ||
| https://www.debian.org/security/2019/dsa-4435 | vendor-advisoryx_refsource_DEBIANThird Party Advisory | |
| https://www.debian.org/security/2019/dsa-4448 | vendor-advisoryx_refsource_DEBIANThird Party Advisory | |
| https://www.debian.org/security/2019/dsa-4451 | vendor-advisoryx_refsource_DEBIANThird Party Advisory | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | x_refsource_MISCThird Party Advisory | |
| https://www.oracle.com/security-alerts/cpuoct2021.html | x_refsource_MISCThird Party Advisory | |
| https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html | x_refsource_MISCPatchThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Feb 4, 2019
Updated May 28, 2026
Reserved Feb 4, 2019
Link CVE-2019-7317
CISA Vulnrichment
Updated May 28, 2026
ENISA EUVD
EUVD-2019-16860 Assigner mitre
Published Feb 4, 2019
Updated May 28, 2026
Exploited since n/a
Link EUVD-2019-16860