Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-28164: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function. CVE-2025-28162: Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libpng | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux · 2023 | libpng-debuginfo | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux · 2023 | libpng-debugsource | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux · 2023 | libpng-devel | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux · 2023 | libpng-devel-debuginfo | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux · 2023 | libpng-static | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux · 2023 | libpng-tools | 2:1.6.37-10.amzn2023.0.10 |
| Amazon Linux · 2023 | libpng-tools-debuginfo | 2:1.6.37-10.amzn2023.0.10 |
Vulnerabilities 2
-
Medium 5.5
Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngi…
-
Medium 5.5
Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_crea…