Description
Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler function is used to strip alpha channels out of the image.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | libpng +1 | 2:1.2.7-1.el4.2 | RHSA-2006:0205 |
Advisories 1
- RHSA-2006:0205 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2006:0205 vendor-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179455
- libpng-pngsetstripalpha-bo(24396) vdb-entry
- 1015617 vdb-entry
- oval:org.mitre.oval:def:10780 vdb-entry signature
- ADV-2006-0393 vdb-entry
- 18654 third-party-advisory
- GLSA-200812-15 vendor-advisory
- 1015615 vdb-entry
- 33137 third-party-advisory
- 18863 third-party-advisory
- 16626 vdb-entry