Description
The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | libpng | 1.2.44-1+squeeze1 | DSA-2287-1 |
| Debian 5.0 | libpng | 1.2.27-2+lenny5 | DSA-2287-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | libpng +2 | 2:1.2.46-1.el6_1 | RHSA-2011:1105 |
| RHEL 5 | libpng +1 | 2:1.2.10-7.1.el5_7.5 | RHSA-2011:1104 |
| RHEL 4 | libpng +1 | 2:1.2.7-8.el4 | RHSA-2011:1103 |
| RHEL 4 | libpng10 +1 | 1.0.16-9.el4 | RHSA-2011:1103 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libpng16 | 1.6.26-1.1 | openSUSE-SU-2024:10050-1 |
Advisories 5
- RHSA-2011:1104 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:1105 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:1103 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2287-1 libpng - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10050-1 libpng16-16-1.6.26-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 49660 third-party-advisory
- RHSA-2011:1103 vendor-advisory
- 48618 vdb-entry
- 45046 third-party-advisory
- USN-1175-1 vendor-advisory
- MDVSA-2011:151 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=720612
- http://sourceforge.net/mailarchive/forum.php?thread_name=003101cc2790%24fb5d6e80%24f2184b80%24%40acm.org&forum_name=png-mng-implement
- GLSA-201206-15 vendor-advisory
- 45461 third-party-advisory
- http://www.libpng.org/pub/png/libpng.html
- http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng%3Ba=commit%3Bh=61a2d8a2a7b03023e63eae9a3e64607aaaa6d339
- FEDORA-2011-9336 vendor-advisory
- DSA-2287 vendor-advisory
- APPLE-SA-2011-10-12-3 vendor-advisory
- 45405 third-party-advisory
- 45445 third-party-advisory
- RHSA-2011:1105 vendor-advisory
- 45460 third-party-advisory
- [oss-security] 20110713 Security issues fixed in libpng 1.5.4 mailing-list
- libpng-png-file-dos(68536) vdb-entry
- http://support.apple.com/kb/HT5002
- 45492 third-party-advisory
- http://support.apple.com/kb/HT5281
- RHSA-2011:1104 vendor-advisory
- VU#819894 third-party-advisory
- APPLE-SA-2012-05-09-1 vendor-advisory
- 45415 third-party-advisory