Description
Portable Network Graphics (PNG) library libpng 1.2.5 and earlier does not correctly calculate offsets, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a buffer overflow attack on the row buffers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | libpng +1 | 2:1.2.2-24 | RHSA-2004:402, RHSA-2004:249 |
| RHEL 3 | libpng10 +1 | 1.0.13-14 | RHSA-2004:402, RHSA-2004:249 |
Advisories 3
- RHSA-2004:402 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:249 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-213 libpng - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2004:402 vendor-advisory
- FLSA:1943 vendor-advisory
- 6431 vdb-entry
- RHSA-2003:007 vendor-advisory
- oval:org.mitre.oval:def:3657 vdb-entry signature
- DSA-213 vendor-advisory
- RHSA-2003:157 vendor-advisory
- MDKSA-2003:008 vendor-advisory
- libpng-file-offset-bo(10925) vdb-entry
- MDKSA-2004:063 vendor-advisory
- RHSA-2003:119 vendor-advisory
- RHSA-2004:249 vendor-advisory
- RHSA-2003:006 vendor-advisory
- SUSE-SA:2003:0004 vendor-advisory