Arch Linux Security Advisory ASA-201904-10
=========================================
Severity: Low
Date    : 2019-04-24
CVE-ID  : CVE-2019-7317
Package : libpng
Type    : denial of service
Remote  : No
Link    : https://security.archlinux.org/AVG-868

Summary
======
The package libpng before version 1.6.37-1 is vulnerable to denial of
service.

Resolution
=========
Upgrade to 1.6.37-1.

# pacman -Syu "libpng>=1.6.37-1"

The problem has been fixed upstream in version 1.6.37.

Workaround
=========
None.

Description
==========
png_image_free in png.c in libpng 1.6.36 has a use-after-free because
png_image_free_function is called under png_safe_execute.

Impact
=====
A remote attacker can crash an application using libpng via a crafted
image.

References
=========
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803
https://github.com/pnggroup/libpng/issues/275
https://security.archlinux.org/CVE-2019-7317