Description
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpng1.6 | 1.6.20-1 | — |
| Debian 13 | libpng1.6 | 1.6.20-1 | — |
| Debian 12 | libpng1.6 | 1.6.20-1 | — |
| Debian 8 | libpng | 1.2.50-2+deb8u2 | DSA-3443-1 |
| Debian 7 | libpng | 1.2.49-1+deb7u2 | DSA-3443-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | libpng | 1.2.50-1ubuntu2.14.04.2 | USN-2861-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.3.30-1jpp.1.el7 | RHSA-2016:0099 |
| RHEL 7 | java-1.8.0-ibm +5 | 1:1.8.0.2.10-1jpp.1.el7 | RHSA-2016:0098 |
| RHEL 7 | libpng +2 | 2:1.5.13-7.el7_2 | RHSA-2015:2596 |
| RHEL 7 | libpng12 +1 | 1.2.50-7.el7_2 | RHSA-2015:2595 |
| RHEL 6 | java-1.6.0-ibm +6 | 1:1.6.0.16.20-1jpp.1.el6_7 | RHSA-2016:0101 |
| RHEL 6 | java-1.7.1-ibm +5 | 1:1.7.1.3.30-1jpp.2.el6_7 | RHSA-2016:0099 |
| RHEL 6 | libpng +2 | 2:1.2.49-2.el6_7 | RHSA-2015:2594 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.16.20-1jpp.1.el5 | RHSA-2016:0101 |
| RHEL 5 | java-1.7.0-ibm +5 | 1:1.7.0.9.30-1jpp.1.el5 | RHSA-2016:0100 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 7 | java-1.6.0-sun +5 | 1:1.6.0.111-1jpp.1.el7 | RHSA-2016:0057 |
| Red Hat Rhel Extras Oracle Java 7 | java-1.7.0-oracle +5 | 1:1.7.0.95-1jpp.2.el7 | RHSA-2016:0056 |
| Red Hat Rhel Extras Oracle Java 7 | java-1.8.0-oracle +5 | 1:1.8.0.71-1jpp.1.el7 | RHSA-2016:0055 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.111-1jpp.3.el6_7 | RHSA-2016:0057 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.7.0-oracle +5 | 1:1.7.0.95-1jpp.1.el6_7 | RHSA-2016:0056 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.8.0-oracle +5 | 1:1.8.0.71-1jpp.1.el6_7 | RHSA-2016:0055 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.6.0-sun +5 | 1:1.6.0.111-1jpp.3.el5_11 | RHSA-2016:0057 |
| Red Hat Rhel Extras Oracle Java 5 | java-1.7.0-oracle +5 | 1:1.7.0.95-1jpp.1.el5_11 | RHSA-2016:0056 |
| Red Hat Network Satellite 5 | java-1.7.0-ibm +1 | 1:1.7.0.9.40-1jpp.1.el5 | RHSA-2016:1430 |
| Red Hat Network Satellite 5 | java-1.7.1-ibm +1 | 1:1.7.1.3.40-1jpp.1.el6_7 | RHSA-2016:1430 |
| Red Hat Network Satellite 5 | spacewalk-java +5 | 2.0.2-109.el5sat | RHSA-2016:1430 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | java-1_7_0-openjdk | 1.7.0.95-24.2 | SUSE-SU-2016:0265-1 |
| SLES 12 SP1 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES 12 SP1 | java-1_8_0-ibm | 1.8.0_sr2.10-7.1 | SUSE-SU-2016:0390-1 |
| SLES 12 | java-1_6_0-ibm | 1.6.0_sr16.20-30.1 | SUSE-SU-2016:0428-1 |
| SLES 12 | java-1_7_0-openjdk | 1.7.0.95-24.2 | SUSE-SU-2016:0265-1 |
| SLES 12 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES 11 SP4 | java-1_7_0-openjdk | 1.7.0.95-0.17.2 | SUSE-SU-2016:0269-1 |
| SLES 11 SP4 | java-1_7_1-ibm | 1.7.1_sr3.30-9.1 | SUSE-SU-2016:0399-1 |
| SLES 11 SP3 | java-1_6_0-ibm | 1.6.0_sr16.20-51.1 | SUSE-SU-2016:0770-1 |
| SLES 11 SP3 | java-1_7_0-ibm | 1.7.0_sr9.30-47.1 | SUSE-SU-2016:0636-1 |
| SLES 11 SP3 | java-1_7_0-openjdk | 1.7.0.95-0.17.2 | SUSE-SU-2016:0269-1 |
| SLES 11 SP2 | java-1_6_0-ibm | 1.6.0_sr16.20-49.1 | SUSE-SU-2016:0431-1 |
| SLES 11 SP2 | java-1_7_0-ibm | 1.7.0_sr9.30-45.1 | SUSE-SU-2016:0433-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | java-1_7_0-openjdk | 1.7.0.95-24.2 | SUSE-SU-2016:0265-1 |
| SLES for SAP 12 SP1 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES for SAP 12 SP1 | java-1_8_0-ibm | 1.8.0_sr2.10-7.1 | SUSE-SU-2016:0390-1 |
| SLES for SAP 12 | java-1_7_0-openjdk | 1.7.0.95-24.2 | SUSE-SU-2016:0265-1 |
| SLES for SAP 12 | java-1_7_1-ibm | 1.7.1_sr3.30-21.1 | SUSE-SU-2016:0401-1 |
| SLES for SAP 11 SP4 | java-1_7_1-ibm | 1.7.1_sr3.30-9.1 | SUSE-SU-2016:0399-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_7_0-openjdk | 1.7.0.121-1.1 | openSUSE-SU-2024:10534-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fltk | 1.3.8-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | libpng +2 | 2:1.5.13-7.el7_2 | ELSA-2015-2596 |
| Oracle Linux 7 | libpng12 +1 | 1.2.50-7.el7_2 | ELSA-2015-2595 |
Advisories 29
- RHSA-2016:1430 Red Hat Security Advisory: java-1.7.0-ibm and java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0101 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0099 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0100 Red Hat Security Advisory: java-1.7.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0056 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0098 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0055 Red Hat Security Advisory: java-1.8.0-oracle security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0057 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2596 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2595 Red Hat Security Advisory: libpng12 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2594 Red Hat Security Advisory: libpng security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2026-0915 Kyocera Drucker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 1, 2026
- USN-2861-1 libpng vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-375-1 libpng - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3443-1 libpng - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-410-1 openjdk-6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:0428-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0770-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0390-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0399-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10534-1 java-1_7_0-openjdk-1.7.0.121-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0269-1 Security update for java-1_7_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0265-1 Security update for java-1_7_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0431-1 Security update for java-1_6_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0433-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0401-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0636-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-2596 Moderate: libpng security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 9, 2015
- ELSA-2015-2595 Moderate: libpng12 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 9, 2015
References
- APPLE-SA-2016-03-21-5 vendor-advisory
- https://support.apple.com/HT206167
- openSUSE-SU-2016:0272 vendor-advisory
- openSUSE-SU-2016:0279 vendor-advisory
- http://sourceforge.net/projects/libpng/files/libpng10/1.0.65/
- http://sourceforge.net/projects/libpng/files/libpng16/1.6.20/
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- RHSA-2016:1430 vendor-advisory
- http://sourceforge.net/projects/libpng/files/libpng15/1.5.25/
- RHSA-2015:2595 vendor-advisory
- RHSA-2015:2596 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- openSUSE-SU-2016:0270 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10148
- SUSE-SU-2016:0269 vendor-advisory
- openSUSE-SU-2016:0263 vendor-advisory
- SUSE-SU-2016:0256 vendor-advisory
- [oss-security] 20151203 Status of CVE-2015-8126: libpng buffer overflow in png_set_PLTE mailing-list
- http://sourceforge.net/projects/libpng/files/libpng12/1.2.55/
- 78624 vdb-entry
- RHSA-2016:0057 vendor-advisory
- RHSA-2016:0055 vendor-advisory
- FEDORA-2015-c80ec85542 vendor-advisory
- http://sourceforge.net/projects/libpng/files/libpng14/1.4.18/
- DSA-3443 vendor-advisory
- RHSA-2016:0056 vendor-advisory
- openSUSE-SU-2016:0268 vendor-advisory
- FEDORA-2015-4ad4998d00 vendor-advisory
- RHSA-2015:2594 vendor-advisory
- FEDORA-2015-233750b6ab vendor-advisory
- SUSE-SU-2016:0265 vendor-advisory