Summary
[2:1.6.34-9]
- CVE-2025-64720: buffer overflow (RHEL-131452)
- CVE-2025-65018: heap buffer overflow (RHEL-131465)
- CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133226)
[2:1.6.34-8]
- Remove redundant fix for CVE-2017-12652
[2:1.6.34-7]
- Add upstream test suite and enable it in gating
[2:1.6.34-6]
- Fix CVE-2017-12652 (#1744871)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | libpng | 2:1.6.34-9.el8_10 |
| Oracle Linux · 8 | libpng-devel | 2:1.6.34-9.el8_10 |
Vulnerabilities 3
-
High 7.1CVE-2025-64720 Public exploit
LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…
-
High 7.1CVE-2025-65018 Public exploit
LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…
-
High 7.1
LIBPNG has an out-of-bounds read in png_image_read_composite
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond …