PT-2019-3289 · Libpng Development Team+7 · Libpng+7
Published
2019-01-25
·
Updated
2026-04-14
·
CVE-2019-7317
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
libpng versions 1.6.x before 1.6.37
Description
The issue is related to a use-after-free vulnerability in the
png image free function, which can be exploited by a remote attacker to cause a denial of service. This occurs because the destructor png image free function is called on freed data. The vulnerability can be triggered using a specially crafted image.Recommendations
For libpng versions 1.6.x before 1.6.37, update to version 1.6.37 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
png image free function until a patch is available. Avoid using the png image free function under png safe execute to minimize the risk of exploitation.Exploit
Fix
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Ibm Aix
Java Platform
Red Hat
Suse
Ubuntu
Libpng