Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 431
Alerts This Week
Warning Icon 1 431

Arch Linux: 201904-10 Low Severity: libpng Denial Of Service

Calendar Apr 26, 2019 • User Avatar LinuxSecurity Advisories
1 min read
Archlinux Large Esm H446
Topics%20covered

Topics Covered

security advisory denial of service libpng low severity Arch Linux
The package libpng before version 1.6.37-1 is vulnerable to denial of service. 
Arch Linux Security Advisory ASA-201904-10
=========================================
Severity: Low
Date    : 2019-04-24
CVE-ID  : CVE-2019-7317
Package : libpng
Type    : denial of service
Remote  : No
Link    : https://security.archlinux.org/AVG-868

Summary
======
The package libpng before version 1.6.37-1 is vulnerable to denial of
service.

Resolution
=========
Upgrade to 1.6.37-1.

# pacman -Syu "libpng>=1.6.37-1"

The problem has been fixed upstream in version 1.6.37.

Workaround
=========
None.

Description
==========
png_image_free in png.c in libpng 1.6.36 has a use-after-free because
png_image_free_function is called under png_safe_execute.

Impact
=====
A remote attacker can crash an application using libpng via a crafted
image.

References
=========
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803
https://github.com/pnggroup/libpng/issues/275
https://security.archlinux.org/CVE-2019-7317