Description
libpng before 1.2.37 does not properly parse 1-bit interlaced images with width values that are not divisible by 8, which causes libpng to include uninitialized bits in certain rows of a PNG file and might allow remote attackers to read portions of sensitive memory via "out-of-bounds pixels" in the file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | libpng | 1.2.27-2+lenny3 | DSA-2032-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libpng +1 | 2:1.2.10-7.1.el5_5.3 | RHSA-2010:0534 |
| RHEL 4 | libpng +1 | 2:1.2.7-3.el4_8.3 | RHSA-2010:0534 |
| RHEL 4 | libpng10 +1 | 1.0.16-3.el4_8.4 | RHSA-2010:0534 |
| RHEL 3 | libpng +1 | 2:1.2.2-30 | RHSA-2010:0534 |
| RHEL 3 | libpng10 +1 | 1.0.13-21 | RHSA-2010:0534 |
Advisories 2
- RHSA-2010:0534 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2032-1 libpng - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- SSA:2009-170-01 vendor-advisory
- ADV-2010-0682 vdb-entry
- 39206 third-party-advisory
- MDVSA-2010:063 vendor-advisory
- [security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues mailing-list
- 39251 third-party-advisory
- libpng-interlaced-image-info-disclosure(50966) vdb-entry
- 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues mailing-list
- 35346 third-party-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- USN-913-1 vendor-advisory
- DSA-2032 vendor-advisory
- http://www.libpng.org/pub/png/libpng.html
- 35524 third-party-advisory
- 35233 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2010-0007.html
- http://support.apple.com/kb/HT4077
- ADV-2010-0637 vdb-entry
- ADV-2009-1510 vdb-entry
- 35594 third-party-advisory
- 39215 third-party-advisory
- 35470 third-party-advisory
- GLSA-200906-01 vendor-advisory
- FEDORA-2009-5977 vendor-advisory
- FEDORA-2009-6400 vendor-advisory
- ADV-2010-0847 vdb-entry
- 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues mailing-list