Description
Multiple off-by-one errors in libpng before 1.2.32beta01, and 1.4 before 1.4.0beta34, allow context-dependent attackers to cause a denial of service (crash) or have unspecified other impact via a PNG image with crafted zTXt chunks, related to (1) the png_push_read_zTXt function in pngread.c, and possibly related to (2) pngtest.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libpng16 | 1.6.37-3.3 | openSUSE-SU-2024:10972-1 |
Advisories 1
- openSUSE-SU-2024:10972-1 libpng16-16-1.6.37-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=624517
- [oss-security] 20080909 CVE request (libpng) mailing-list
- 35386 third-party-advisory
- 1020521 vendor-advisory
- libpng-pngpushreadztxt-dos(44928) vdb-entry
- ADV-2009-1560 vdb-entry
- ADV-2009-1462 vdb-entry
- 31049 vdb-entry
- 259989 vendor-advisory
- 35302 third-party-advisory
- [oss-security] 20080909 Re: CVE request (libpng) mailing-list
- VU#889484 third-party-advisory
- ADV-2008-2512 vdb-entry
- GLSA-200812-15 vendor-advisory
- 31781 third-party-advisory
- 33137 third-party-advisory
- [png-mng-implement] 20080918 libpng-1.0.40 and libpng-1.2.32 available mailing-list
- http://sourceforge.net/project/shownotes.php?release_id=624518
- http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm
- MDVSA-2009:051 vendor-advisory
- http://sourceforge.net/tracker/index.php?func=detail&aid=2095669&group_id=5624&atid=105624