Summary
[2:1.6.40-8.1]
- CVE-2025-64720: buffer overflow (RHEL-131422)
- CVE-2025-65018: heap buffer overflow (RHEL-131435)
- CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133212)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | libpng | 2:1.6.40-8.el10_1.1 |
| Oracle Linux · 10 | libpng-devel | 2:1.6.40-8.el10_1.1 |
Vulnerabilities 3
-
High 7.1CVE-2025-64720 Public exploit
LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…
-
High 7.1CVE-2025-65018 Public exploit
LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…
-
High 7.1
LIBPNG has an out-of-bounds read in png_image_read_composite
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond …