Description
The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | libpng | 1.2.50-2+deb8u1 | DSA-3399-1 |
| Debian 7 | libpng | 1.2.49-1+deb7u1 | DSA-3399-1 |
| Debian 6.0 | libpng | 1.2.44-1+squeeze5 | DLA-343-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | libpng | 1.2.50-1ubuntu2.14.04.1 | USN-2815-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.3.30-1jpp.1.el7 | RHSA-2016:0099 |
| RHEL 7 | libpng12 +1 | 1.2.50-7.el7_2 | RHSA-2015:2595 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.16.20-1jpp.1.el6_7 | RHSA-2016:0101 |
| RHEL 6 | java-1.7.1-ibm +5 | 1:1.7.1.3.30-1jpp.2.el6_7 | RHSA-2016:0099 |
| RHEL 6 | libpng +2 | 2:1.2.49-2.el6_7 | RHSA-2015:2594 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.16.20-1jpp.1.el5 | RHSA-2016:0101 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.9.30-1jpp.1.el5 | RHSA-2016:0100 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | java-1.7.0-ibm +1 | 1:1.7.0.9.40-1jpp.1.el5 | RHSA-2016:1430 |
| Red Hat Network Satellite 5 | java-1.7.1-ibm +1 | 1:1.7.1.3.40-1jpp.1.el6_7 | RHSA-2016:1430 |
| Red Hat Network Satellite 5 | spacewalk-java +5 | 2.0.2-109.el5sat | RHSA-2016:1430 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES 12 | java-1_6_0-ibm | 1.6.0_sr16.20-30.1 | SUSE-SU-2016:0428-1 |
| SLES 12 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES 12 | libpng12 | 1.2.50-10.1 | SUSE-SU-2015:2024-1 |
| SLES 11 SP4 | java-1_7_1-ibm | 1.7.1_sr3.30-9.1 | SUSE-SU-2016:0399-1 |
| SLES 11 SP4 | libpng12-0 | 1.2.31-5.35.1 | SUSE-SU-2015:2017-1 |
| SLES 11 SP3 | java-1_6_0-ibm | 1.6.0_sr16.20-51.1 | SUSE-SU-2016:0770-1 |
| SLES 11 SP3 | java-1_7_0-ibm | 1.7.0_sr9.30-47.1 | SUSE-SU-2016:0636-1 |
| SLES 11 SP3 | libpng12-0 | 1.2.31-5.35.1 | SUSE-SU-2015:2017-1 |
| SLES 11 SP2 | java-1_6_0-ibm | 1.6.0_sr16.20-49.1 | SUSE-SU-2016:0431-1 |
| SLES 11 SP2 | java-1_7_0-ibm | 1.7.0_sr9.30-45.1 | SUSE-SU-2016:0433-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES for SAP 12 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES for SAP 12 | libpng12 | 1.2.50-10.1 | SUSE-SU-2015:2024-1 |
| SLES for SAP 11 SP4 | java-1_7_1-ibm | 1.7.1_sr3.30-9.1 | SUSE-SU-2016:0399-1 |
| SLES for SAP 11 SP4 | libpng12-0 | 1.2.31-5.35.1 | SUSE-SU-2015:2017-1 |
| SLES for SAP 11 SP3 | libpng12-0 | 1.2.31-5.35.1 | SUSE-SU-2015:2017-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | vlc | 2.2.4-11.1 | openSUSE-SU-2024:10064-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | syslinux | 6.04-11 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libpng12 +1 | 1.2.50-7.el7_2 | ELSA-2015-2595 |
Advisories 21
- RHSA-2016:1430 Red Hat Security Advisory: java-1.7.0-ibm and java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0101 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0100 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0099 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2595 Red Hat Security Advisory: libpng12 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2594 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-2815-1 libpng vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3399-1 libpng - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-343-1 libpng - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10064-1 libvlc5-2.2.4-11.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0428-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0770-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0399-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:2017-1 Security update for libpng12-0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0431-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0433-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0401-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0636-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1960 libpng: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 30, 2025
- SUSE-SU-2015:2024-1 Security update for libpng12 SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2015-2595 Moderate: libpng12 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 9, 2015
References
- 77304 vdb-entry
- [oss-security] 20151026 CVE Requests for read out of bound in libpng mailing-list
- openSUSE-SU-2015:2136 vendor-advisory
- http://sourceforge.net/projects/libpng/files/libpng10/1.0.64/
- FEDORA-2015-ec2ddd15d7 vendor-advisory
- GLSA-201611-08 vendor-advisory
- [oss-security] 20151026 Re: CVE Requests for read out of bound in libpng mailing-list
- FEDORA-2015-501493d853 vendor-advisory
- http://sourceforge.net/projects/libpng/files/libpng12/1.2.54/
- RHSA-2016:1430 vendor-advisory
- FEDORA-2015-1d87313b7c vendor-advisory
- DSA-3399 vendor-advisory
- RHSA-2015:2595 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://sourceforge.net/projects/libpng/files/libpng14/1.4.17/
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- 1034393 vdb-entry
- http://sourceforge.net/p/libpng/bugs/241/
- openSUSE-SU-2015:2099 vendor-advisory
- USN-2815-1 vendor-advisory
- RHSA-2015:2594 vendor-advisory