Description
libpng 1.0.6 through 1.0.32, 1.2.0 through 1.2.26, and 1.4.0beta01 through 1.4.0beta19 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG file with zero length "unknown" chunks, which trigger an access of uninitialized memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libpng +1 | 2:1.2.10-7.1.el5_3.2 | RHSA-2009:0333 |
| RHEL 4 | libpng +1 | 2:1.2.7-3.el4_7.2 | RHSA-2009:0333 |
| RHEL 4 | libpng10 +1 | 1.0.16-3.el4_7.3 | RHSA-2009:0333 |
| RHEL 2 | libpng +1 | 2:1.0.14-12 | RHSA-2009:0333 |
Advisories 1
- RHSA-2009:0333 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- SUSE-SR:2008:010 vendor-advisory
- RHSA-2009:0333 vendor-advisory
- 35386 third-party-advisory
- ADV-2008-1225 vdb-entry
- 30157 third-party-advisory
- 30174 third-party-advisory
- 1020521 vendor-advisory
- http://support.apple.com/kb/HT3549
- APPLE-SA-2008-09-15 vendor-advisory
- 44364 vdb-entry
- ADV-2009-1560 vdb-entry
- 34388 third-party-advisory
- ADV-2009-1462 vdb-entry
- GLSA-200805-10 vendor-advisory
- FEDORA-2008-4910 vendor-advisory
- FEDORA-2008-3937 vendor-advisory
- 30486 third-party-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0151
- http://www.vmware.com/security/advisories/VMSA-2009-0007.html
- TA08-260A third-party-advisory
- 30402 third-party-advisory
- 259989 vendor-advisory
- 35302 third-party-advisory
- FEDORA-2008-4847 vendor-advisory
- SSA:2008-119-01 vendor-advisory
- 20080429 rPSA-2008-0151-1 libpng mailing-list
- 35074 third-party-advisory
- ADV-2008-2584 vdb-entry
- 29792 third-party-advisory
- 1019840 vdb-entry
- ADV-2009-1451 vdb-entry
- APPLE-SA-2009-05-12 vendor-advisory
- 31882 third-party-advisory
- GLSA-200804-15 vendor-advisory
- 29992 third-party-advisory
- FEDORA-2008-3683 vendor-advisory
- 20090529 VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues mailing-list
- 29678 third-party-advisory
- libpng-zero-length-code-execution(41800) vdb-entry
- GLSA-200812-15 vendor-advisory
- DSA-1750 vendor-advisory
- http://www.ocert.org/advisories/ocert-2008-003.html
- 20080414 [oCERT-2008-003] libpng zero-length chunks incorrect handling mailing-list
- http://libpng.sourceforge.net/Advisory-1.2.26.txt
- oval:org.mitre.oval:def:10326 vdb-entry signature
- TA09-133A third-party-advisory
- ADV-2009-1297 vdb-entry
- 33137 third-party-advisory
- oval:org.mitre.oval:def:6275 vdb-entry signature
- 34152 third-party-advisory
- MDVSA-2008:156 vendor-advisory
- 35258 third-party-advisory
- 30009 third-party-advisory
- 28770 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm
- 29957 third-party-advisory
- FEDORA-2008-3979 vendor-advisory
- FEDORA-2008-4947 vendor-advisory