PT-2019-3289 · Libpng Development Team+7 · Libpng+7
Publicado
2019-01-25
·
Atualizado
2026-04-14
·
CVE-2019-7317
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libpng versions 1.6.x before 1.6.37
Description
The issue is related to a use-after-free vulnerability in the
png image free function, which can be exploited by a remote attacker to cause a denial of service. This occurs because the destructor png image free function is called on freed data. The vulnerability can be triggered using a specially crafted image.Recommendations
For libpng versions 1.6.x before 1.6.37, update to version 1.6.37 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
png image free function until a patch is available. Avoid using the png image free function under png safe execute to minimize the risk of exploitation.Exploit
Correção
DoS
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Ibm Aix
Java Platform
Red Hat
Suse
Ubuntu
Libpng