Description
The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | icedove | 2.0.0.22-0lenny1 | DSA-1830-1 |
| Debian 5.0 | libpng | 1.2.27-2+lenny2 | DSA-1750-1 |
| Debian 4.0 | libpng | 1.2.15~beta5-1+etch2 | DSA-1750-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | firefox | 3.0.7-1.el5 | RHSA-2009:0315 |
| RHEL 5 | libpng +1 | 2:1.2.10-7.1.el5_3.2 | RHSA-2009:0333 |
| RHEL 5 | xulrunner +2 | 1.9.0.7-1.el5 | RHSA-2009:0315 |
| RHEL 4 | firefox | 3.0.7-1.el4 | RHSA-2009:0315 |
| RHEL 4 | libpng +1 | 2:1.2.7-3.el4_7.2 | RHSA-2009:0333 |
| RHEL 4 | libpng10 +1 | 1.0.16-3.el4_7.3 | RHSA-2009:0333 |
| RHEL 4 | seamonkey +5 | 1.0.9-38.el4 | RHSA-2009:0325 |
| RHEL 3 | libpng +1 | 2:1.2.2-29 | RHSA-2009:0340 |
| RHEL 3 | libpng10 +1 | 1.0.13-20 | RHSA-2009:0340 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.34.el3 | RHSA-2009:0325 |
| RHEL 2 | libpng +1 | 2:1.0.14-12 | RHSA-2009:0333 |
| RHEL 2 | seamonkey +9 | 1.0.9-0.30.el2 | RHSA-2009:0325 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
| openSUSE Tumbleweed | libpng16 | 1.6.37-3.3 | openSUSE-SU-2024:10972-1 |
Advisories 10
- RHSA-2009:0333 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0315 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0340 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0325 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1830-1 icedove - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1750-1 libpng - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10972-1 libpng16-16-1.6.37-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- RHSA-2009:0315 vendor-advisory
- SUSE-SA:2009:023 vendor-advisory
- http://support.apple.com/kb/HT3757
- SUSE-SA:2009:012 vendor-advisory
- GLSA-200903-28 vendor-advisory
- RHSA-2009:0333 vendor-advisory
- http://support.apple.com/kb/HT3639
- 35386 third-party-advisory
- GLSA-201209-25 vendor-advisory
- DSA-1830 vendor-advisory
- ADV-2009-0632 vdb-entry
- ADV-2009-1621 vdb-entry
- RHSA-2009:0340 vendor-advisory
- 1020521 vendor-advisory
- http://support.apple.com/kb/HT3549
- ADV-2009-1560 vdb-entry
- oval:org.mitre.oval:def:10316 vdb-entry signature
- ADV-2009-0469 vdb-entry
- 34388 third-party-advisory
- ADV-2009-1462 vdb-entry
- SSA:2009-083-02 vendor-advisory
- APPLE-SA-2009-06-08-1 vendor-advisory
- 36096 third-party-advisory
- [png-mng-implement] 20090219 libpng-1.2.35 and libpng-1.0.43 fix security vulnerability mailing-list
- http://www.vmware.com/security/advisories/VMSA-2009-0007.html
- RHSA-2009:0325 vendor-advisory
- 259989 vendor-advisory
- 35302 third-party-advisory
- 33976 third-party-advisory
- 35074 third-party-advisory
- libpng-pointer-arrays-code-execution(48819) vdb-entry
- ADV-2009-1522 vdb-entry
- 34140 third-party-advisory
- ADV-2009-1451 vdb-entry
- APPLE-SA-2009-06-17-1 vendor-advisory
- FEDORA-2009-2045 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- SUSE-SR:2009:005 vendor-advisory
- MDVSA-2009:083 vendor-advisory
- 34464 third-party-advisory
- 34272 third-party-advisory
- 34210 third-party-advisory
- APPLE-SA-2009-08-05-1 vendor-advisory
- oval:org.mitre.oval:def:6458 vdb-entry signature
- 34265 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0046
- 34145 third-party-advisory
- 20090529 VMSA-2009-0007 VMware Hosted products and ESX and ESXi patches resolve security issues mailing-list
- 35379 third-party-advisory
- ADV-2009-0473 vdb-entry
- 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list
- 34143 third-party-advisory
- FEDORA-2009-2882 vendor-advisory
- DSA-1750 vendor-advisory
- FEDORA-2009-2884 vendor-advisory
- SSA:2009-083-03 vendor-advisory
- 33970 third-party-advisory
- 34137 third-party-advisory
- TA09-133A third-party-advisory
- [security-announce] 20090820 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server mailing-list