Description
The png_handle_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of service (application crash) via a grayscale PNG image with a bad tRNS chunk CRC value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 13 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 12 | libgd2 | 2.0.35.dfsg-1 | — |
| Debian 4.0 | libgd2 | 2.0.33-5.2etch1 | DSA-1613-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libpng +1 | 2:1.2.10-7.0.2 | RHSA-2007:0356 |
| RHEL 4 | libpng +1 | 2:1.2.7-3.el4 | RHSA-2007:0356 |
| RHEL 4 | libpng10 +1 | 1.0.16-3 | RHSA-2007:0356 |
| RHEL 3 | libpng +1 | 2:1.2.2-27 | RHSA-2007:0356 |
| RHEL 3 | libpng10 +1 | 1.0.13-17 | RHSA-2007:0356 |
| RHEL 2 | libpng +1 | 2:1.0.14-10 | RHSA-2007:0356 |
Advisories 2
- RHSA-2007:0356 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1613-1 libgd2 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- OpenPKG-SA-2007.013 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-254.htm
- SSA:2007-136-01 vendor-advisory
- 25571 third-party-advisory
- oval:org.mitre.oval:def:10094 vdb-entry signature
- VU#684664 third-party-advisory
- DSA-1613 vendor-advisory
- 102987 vendor-advisory
- 200871 vendor-advisory
- 34388 third-party-advisory
- 36196 vdb-entry
- GLSA-200705-24 vendor-advisory
- 25273 third-party-advisory
- http://www.coresecurity.com/?action=item&id=2148
- http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/l/li/libpng/libpng-1.2.17-ADVISORY.txt
- 24023 vdb-entry
- libpng-trns-chunk-dos(34340) vdb-entry
- ADV-2008-0924 vdb-entry
- http://irrlicht.sourceforge.net/changes.txt
- 25867 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=508653&group_id=5624
- 31168 third-party-advisory
- https://issues.rpath.com/browse/RPL-1381
- 25329 third-party-advisory
- 25461 third-party-advisory
- ADV-2007-1838 vdb-entry
- 29420 third-party-advisory
- ADV-2007-2385 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=508656&group_id=5624
- APPLE-SA-2008-03-18 vendor-advisory
- 25353 third-party-advisory
- http://android-developers.blogspot.com/2008/03/android-sdk-update-m5-rc15-released.html
- 20070517 FLEA-2007-0018-1: libpng mailing-list
- 30161 third-party-advisory
- GLSA-200805-07 vendor-advisory
- 25554 third-party-advisory
- 25268 third-party-advisory
- DSA-1750 vendor-advisory
- 1018078 vdb-entry
- 2007-0019 vendor-advisory
- SUSE-SR:2007:013 vendor-advisory
- USN-472-1 vendor-advisory
- 27056 third-party-advisory
- RHSA-2007:0356 vendor-advisory
- 25292 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=307562
- 25787 third-party-advisory
- 25742 third-party-advisory
- MDKSA-2007:116 vendor-advisory
- 24000 vdb-entry
- 20080304 CORE-2008-0124: Multiple vulnerabilities in Google's Android SDK mailing-list