CVEvulnerability
CVE-2019-7317
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-02-04
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-416
Description
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Affected configurations
• libpng libpng (>= 1.6.0 < 1.6.37)
• debian debian linux 8.0
• debian debian linux 9.0
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
• canonical ubuntu linux 19.04
• oracle hyperion infrastructure technology 11.2.6.0
• oracle java se 7u221
• oracle java se 8u212
• oracle jdk 11.0.3
• oracle jdk 12.0.1
• oracle mysql (< 8.0.23)
• hp xp7 command view (< 8.7.0-00)
• hpe xp7 command view advanced edition suite (< 8.7.0-00)
• mozilla firefox
• mozilla thunderbird
• opensuse leap 15.0
• opensuse leap 15.1
• opensuse leap 42.3
• opensuse package hub
• netapp active iq unified manager (< 9.6)
• netapp active iq unified manager 9.6
• netapp cloud backup
• netapp e-series santricity management
• netapp e-series santricity storage manager (< 11.53)
• netapp e-series santricity unified manager (< 3.2)
• netapp e-series santricity web services (< 4.0)
• netapp oncommand insight (< 7.3.9)
• netapp oncommand workflow automation (< 5.1)
• netapp plug-in for symantec netbackup
• netapp snapmanager (< 3.4.2)
• netapp snapmanager 3.4.2
• netapp steelstore
• redhat satellite 5.8
• redhat enterprise linux 6.0
• redhat enterprise linux 7.0
• redhat enterprise linux 8.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux for ibm z systems 6.0
• redhat enterprise linux for ibm z systems 7.0
• redhat enterprise linux for ibm z systems 8.0
• redhat enterprise linux for power big endian 6.0
• redhat enterprise linux for power big endian 7.0
• redhat enterprise linux for power little endian 7.0
• redhat enterprise linux for power little endian 8.0
• redhat enterprise linux for scientific computing 6.0
• redhat enterprise linux for scientific computing 7.0
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/108098 Not Applicable, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1265 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1267 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1269 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1308 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1309 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1310 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2494 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2495 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2585 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2590 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2592 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2737 Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803 Issue Tracking, Mailing List, Third Party Advisory
- https://github.com/glennrp/libpng/issues/275 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Apr/30 Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Apr/36 Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/56 Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/59 Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/67 Issue Tracking, Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201908-02 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190719-0005/ Third Party Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us Third Party Advisory
- https://usn.ubuntu.com/3962-1/ Third Party Advisory
- https://usn.ubuntu.com/3991-1/ Third Party Advisory
- https://usn.ubuntu.com/3997-1/ Third Party Advisory
- https://usn.ubuntu.com/4080-1/ Third Party Advisory
- https://usn.ubuntu.com/4083-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4435 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4448 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4451 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Third Party Advisory
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/108098 Not Applicable, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1265 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1267 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1269 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1308 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1309 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1310 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2494 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2495 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2585 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2590 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2592 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2737 Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803 Issue Tracking, Mailing List, Third Party Advisory
- https://github.com/glennrp/libpng/issues/275 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Apr/30 Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Apr/36 Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/56 Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/59 Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/67 Issue Tracking, Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201908-02 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190719-0005/ Third Party Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us Third Party Advisory
- https://usn.ubuntu.com/3962-1/ Third Party Advisory
- https://usn.ubuntu.com/3991-1/ Third Party Advisory
- https://usn.ubuntu.com/3997-1/ Third Party Advisory
- https://usn.ubuntu.com/4080-1/ Third Party Advisory
- https://usn.ubuntu.com/4083-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4435 Third Party Advisory
- https://www.debian.org/security/2019/dsa-4448 Third Party Advisory