Description
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | chromium-browser | 49.0.2623.75-1~deb8u1 | DSA-3507-1 |
| Debian 8 | libpng | 1.2.50-2+deb8u1 | DSA-3399-1 |
| Debian 7 | libpng | 1.2.49-1+deb7u1 | DSA-3399-1 |
| Debian 6.0 | libpng | 1.2.44-1+squeeze5 | DLA-343-1 |
| Debian 6.0 | openjdk-6 | 6b38-1.13.10-1~deb6u1 | DLA-410-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | libpng | 1.2.50-1ubuntu2.14.04.1 | USN-2815-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.3.30-1jpp.1.el7 | RHSA-2016:0099 |
| RHEL 7 | java-1.8.0-ibm +5 | 1:1.8.0.2.10-1jpp.1.el7 | RHSA-2016:0098 |
| RHEL 7 | libpng +2 | 2:1.5.13-7.el7_2 | RHSA-2015:2596 |
| RHEL 7 | libpng12 +1 | 1.2.50-7.el7_2 | RHSA-2015:2595 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.16.20-1jpp.1.el6_7 | RHSA-2016:0101 |
| RHEL 6 | java-1.7.1-ibm +5 | 1:1.7.1.3.30-1jpp.2.el6_7 | RHSA-2016:0099 |
| RHEL 6 | libpng +2 | 2:1.2.49-2.el6_7 | RHSA-2015:2594 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.16.20-1jpp.1.el5 | RHSA-2016:0101 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.9.30-1jpp.1.el5 | RHSA-2016:0100 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 7 | java-1.6.0-sun +5 | 1:1.6.0.111-1jpp.1.el7 | RHSA-2016:0057 |
| Red Hat Rhel Extras Oracle Java 7 | java-1.7.0-oracle +5 | 1:1.7.0.95-1jpp.2.el7 | RHSA-2016:0056 |
| Red Hat Rhel Extras Oracle Java 7 | java-1.8.0-oracle +5 | 1:1.8.0.71-1jpp.1.el7 | RHSA-2016:0055 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.111-1jpp.3.el6_7 | RHSA-2016:0057 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.7.0-oracle +5 | 1:1.7.0.95-1jpp.1.el6_7 | RHSA-2016:0056 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.8.0-oracle +5 | 1:1.8.0.71-1jpp.1.el6_7 | RHSA-2016:0055 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.111-1jpp.3.el5_11 | RHSA-2016:0057 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.7.0-oracle +5 | 1:1.7.0.95-1jpp.1.el5_11 | RHSA-2016:0056 |
| Red Hat Network Satellite 5 | java-1.7.0-ibm +1 | 1:1.7.0.9.40-1jpp.1.el5 | RHSA-2016:1430 |
| Red Hat Network Satellite 5 | java-1.7.1-ibm +1 | 1:1.7.1.3.40-1jpp.1.el6_7 | RHSA-2016:1430 |
| Red Hat Network Satellite 5 | spacewalk-java +5 | 2.0.2-109.el5sat | RHSA-2016:1430 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | java-1_7_0-openjdk | 1.7.0.95-24.2 | SUSE-SU-2016:0265-1 |
| SLES 12 SP1 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES 12 SP1 | java-1_8_0-ibm | 1.8.0_sr2.10-7.1 | SUSE-SU-2016:0390-1 |
| SLES 12 SP1 | java-1_8_0-openjdk | 1.8.0.72-3.2 | SUSE-SU-2016:0256-1 |
| SLES 12 SP1 | libpng12 | 1.2.50-13.1 | SUSE-SU-2016:0050-1 |
| SLES 12 SP1 | libpng15 | 1.5.22-4.1 | SUSE-SU-2016:0041-1 |
| SLES 12 SP1 | libpng16 | 1.6.8-11.1 | SUSE-SU-2016:0027-1 |
| SLES 12 | java-1_6_0-ibm | 1.6.0_sr16.20-30.1 | SUSE-SU-2016:0428-1 |
| SLES 12 | java-1_7_0-openjdk | 1.7.0.95-24.2 | SUSE-SU-2016:0265-1 |
| SLES 12 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES 12 | libpng12 | 1.2.50-10.1 | SUSE-SU-2016:0050-1, SUSE-SU-2015:2024-1 |
| SLES 12 | libpng16 | 1.6.8-8.1 | SUSE-SU-2016:0027-1, SUSE-SU-2015:2013-1 |
| SLES 11 SP4 | java-1_7_0-openjdk | 1.7.0.95-0.17.2 | SUSE-SU-2016:0269-1 |
| SLES 11 SP4 | java-1_7_1-ibm | 1.7.1_sr3.30-9.1 | SUSE-SU-2016:0399-1 |
| SLES 11 SP4 | libpng12-0 | 1.2.31-5.35.1 | SUSE-SU-2016:0061-1, SUSE-SU-2015:2017-1 |
| SLES 11 SP3 | java-1_6_0-ibm | 1.6.0_sr16.20-51.1 | SUSE-SU-2016:0770-1 |
| SLES 11 SP3 | java-1_7_0-ibm | 1.7.0_sr9.30-47.1 | SUSE-SU-2016:0636-1 |
| SLES 11 SP3 | java-1_7_0-openjdk | 1.7.0.95-0.17.2 | SUSE-SU-2016:0269-1 |
| SLES 11 SP3 | libpng12-0 | 1.2.31-5.35.1 | SUSE-SU-2016:0061-1, SUSE-SU-2015:2017-1 |
| SLES 11 SP2 | java-1_6_0-ibm | 1.6.0_sr16.20-49.1 | SUSE-SU-2016:0431-1 |
| SLES 11 SP2 | java-1_7_0-ibm | 1.7.0_sr9.30-45.1 | SUSE-SU-2016:0433-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | java-1_7_0-openjdk | 1.7.0.95-24.2 | SUSE-SU-2016:0265-1 |
| SLES for SAP 12 SP1 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES for SAP 12 SP1 | java-1_8_0-ibm | 1.8.0_sr2.10-7.1 | SUSE-SU-2016:0390-1 |
| SLES for SAP 12 SP1 | java-1_8_0-openjdk | 1.8.0.72-3.2 | SUSE-SU-2016:0256-1 |
| SLES for SAP 12 SP1 | libpng12 | 1.2.50-13.1 | SUSE-SU-2016:0050-1 |
| SLES for SAP 12 SP1 | libpng15 | 1.5.22-4.1 | SUSE-SU-2016:0041-1 |
| SLES for SAP 12 SP1 | libpng16 | 1.6.8-11.1 | SUSE-SU-2016:0027-1 |
| SLES for SAP 12 | java-1_7_0-openjdk | 1.7.0.95-24.2 | SUSE-SU-2016:0265-1 |
| SLES for SAP 12 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES for SAP 12 | libpng12 | 1.2.50-10.1 | SUSE-SU-2016:0050-1, SUSE-SU-2015:2024-1 |
| SLES for SAP 12 | libpng16 | 1.6.8-8.1 | SUSE-SU-2016:0027-1, SUSE-SU-2015:2013-1 |
| SLES for SAP 11 SP4 | java-1_7_1-ibm | 1.7.1_sr3.30-9.1 | SUSE-SU-2016:0399-1 |
| SLES for SAP 11 SP4 | libpng12-0 | 1.2.31-5.35.1 | SUSE-SU-2016:0061-1, SUSE-SU-2015:2017-1 |
| SLES for SAP 11 SP3 | libpng12-0 | 1.2.31-5.35.1 | SUSE-SU-2016:0061-1, SUSE-SU-2015:2017-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | chromium | 55.0.2883.75-3.1 | openSUSE-SU-2024:12948-1, openSUSE-SU-2024:10171-1 |
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
| openSUSE Tumbleweed | java-1_8_0-openjdk | 1.8.0.111-1.1 | openSUSE-SU-2024:10197-1 |
| openSUSE Tumbleweed | libpng16 | 1.6.26-1.1 | openSUSE-SU-2024:10050-1 |
| openSUSE Tumbleweed | vlc | 2.2.4-11.1 | openSUSE-SU-2024:10064-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fltk | 1.3.8-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libpng +2 | 2:1.5.13-7.el7_2 | ELSA-2015-2596 |
| Oracle Linux 7 | libpng12 +1 | 1.2.50-7.el7_2 | ELSA-2015-2595 |
Advisories 44
- RHSA-2016:1430 Red Hat Security Advisory: java-1.7.0-ibm and java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0101 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0100 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0099 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0056 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0098 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0055 Red Hat Security Advisory: java-1.8.0-oracle security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0057 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2595 Red Hat Security Advisory: libpng12 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2596 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2594 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2026-0915 Kyocera Drucker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- USN-2815-1 libpng vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3399-1 libpng - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-410-1 openjdk-6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3507-1 chromium-browser - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-343-1 libpng - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10171-1 chromedriver-55.0.2883.75-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10064-1 libvlc5-2.2.4-11.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0428-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0770-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0027-1 Security update for libpng16 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10050-1 libpng16-16-1.6.26-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0390-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0050-1 Security update for libpng12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0399-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:2017-1 Security update for libpng12-0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0269-1 Security update for java-1_7_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0265-1 Security update for java-1_7_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0041-1 Security update for libpng15 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0256-1 Security update for java-1_8_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0431-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0433-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:2013-1 Security update for libpng16 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12948-1 ungoogled-chromium-113.0.5672.92-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0401-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0636-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0061-1 Security update for libpng12-0 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10197-1 java-1_8_0-openjdk-1.8.0.111-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1959 libpng: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 30, 2025
- SUSE-SU-2015:2024-1 Security update for libpng12 SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2015-2596 Moderate: libpng security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 9, 2015
- ELSA-2015-2595 Moderate: libpng12 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 9, 2015
References
- APPLE-SA-2016-03-21-5 vendor-advisory
- openSUSE-SU-2016:0664 vendor-advisory
- openSUSE-SU-2016:0103 vendor-advisory
- openSUSE-SU-2016:0684 vendor-advisory
- https://support.apple.com/HT206167
- openSUSE-SU-2015:2135 vendor-advisory
- openSUSE-SU-2015:2136 vendor-advisory
- 77568 vdb-entry
- openSUSE-SU-2016:0272 vendor-advisory
- FEDORA-2015-5e52306c9c vendor-advisory
- FEDORA-2015-ec2ddd15d7 vendor-advisory
- GLSA-201611-08 vendor-advisory
- openSUSE-SU-2016:0279 vendor-advisory
- DSA-3507 vendor-advisory
- FEDORA-2015-501493d853 vendor-advisory
- 1034142 vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- RHSA-2016:1430 vendor-advisory
- FEDORA-2015-1d87313b7c vendor-advisory
- DSA-3399 vendor-advisory
- RHSA-2015:2595 vendor-advisory
- RHSA-2015:2596 vendor-advisory
- openSUSE-SU-2015:2262 vendor-advisory
- FEDORA-2015-8a1243db75 vendor-advisory
- FEDORA-2015-13668fff74 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- openSUSE-SU-2016:0270 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10148
- openSUSE-SU-2015:2100 vendor-advisory
- [oss-security] 20151112 CVE request: libpng buffer overflow in png_set_PLTE mailing-list
- SUSE-SU-2016:0269 vendor-advisory
- openSUSE-SU-2016:0105 vendor-advisory
- FEDORA-2015-97fc1797fa vendor-advisory
- openSUSE-SU-2016:0729 vendor-advisory
- openSUSE-SU-2016:0263 vendor-advisory
- SUSE-SU-2016:0256 vendor-advisory
- FEDORA-2016-43735c33a7 vendor-advisory
- SUSE-SU-2016:0665 vendor-advisory
- GLSA-201603-09 vendor-advisory
- FEDORA-2016-9a1c707b10 vendor-advisory
- openSUSE-SU-2015:2263 vendor-advisory
- RHSA-2016:0057 vendor-advisory
- RHSA-2016:0055 vendor-advisory
- FEDORA-2015-c80ec85542 vendor-advisory
- openSUSE-SU-2015:2099 vendor-advisory
- USN-2815-1 vendor-advisory
- RHSA-2016:0056 vendor-advisory
- openSUSE-SU-2016:0268 vendor-advisory
- FEDORA-2015-4ad4998d00 vendor-advisory
- RHSA-2015:2594 vendor-advisory
- FEDORA-2015-233750b6ab vendor-advisory
- https://code.google.com/p/chromium/issues/detail?id=560291
- http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html
- SUSE-SU-2016:0265 vendor-advisory
- openSUSE-SU-2016:0104 vendor-advisory