Description
The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpng1.6 | 1.6.27-1 | — |
| Debian 13 | libpng1.6 | 1.6.27-1 | — |
| Debian 12 | libpng1.6 | 1.6.27-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libpng1.6 | 1.6.34-1ubuntu0.18.04.1 | USN-3712-1 |
| Ubuntu 16.04 LTS | libpng | 1.2.54-1ubuntu1.1 | USN-3712-1 |
| Ubuntu 14.04 LTS | libpng | 1.2.50-1ubuntu2.14.04.3 | USN-3712-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libpng1.6 | 1.6.20-2ubuntu0.1~esm4 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | libpng12 | 1.2.50-19.1 | SUSE-SU-2017:0860-1 |
| SLES 12 SP2 | libpng15 | 1.5.22-9.1 | SUSE-SU-2017:0950-1 |
| SLES 12 SP2 | libpng16 | 1.6.8-14.1 | SUSE-SU-2017:0853-1 |
| SLES 12 SP1 | libpng12 | 1.2.50-19.1 | SUSE-SU-2017:0860-1 |
| SLES 12 SP1 | libpng15 | 1.5.22-9.1 | SUSE-SU-2017:0950-1 |
| SLES 12 SP1 | libpng16 | 1.6.8-14.1 | SUSE-SU-2017:0853-1 |
| SLES 11 SP4 | libpng12-0 | 1.2.31-5.43.1 | SUSE-SU-2017:0901-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | libpng12 | 1.2.50-19.1 | SUSE-SU-2017:0860-1 |
| SLES for SAP 12 SP2 | libpng15 | 1.5.22-9.1 | SUSE-SU-2017:0950-1 |
| SLES for SAP 12 SP2 | libpng16 | 1.6.8-14.1 | SUSE-SU-2017:0853-1 |
| SLES for SAP 12 SP1 | libpng12 | 1.2.50-19.1 | SUSE-SU-2017:0860-1 |
| SLES for SAP 12 SP1 | libpng15 | 1.5.22-9.1 | SUSE-SU-2017:0950-1 |
| SLES for SAP 12 SP1 | libpng16 | 1.6.8-14.1 | SUSE-SU-2017:0853-1 |
| SLES for SAP 11 SP4 | libpng12-0 | 1.2.31-5.43.1 | SUSE-SU-2017:0901-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libpng16 | 1.6.37-3.3 | openSUSE-SU-2024:10972-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | fltk | 1.3.8-1 | — |
| Azure Linux 3 | openjpeg2 | No fix yet | — |
Advisories 7
- WID-SEC-2026-2061 libpng: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 17, 2026
- USN-3712-1 libpng, libpng1.6 vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- SUSE-SU-2017:0950-1 Security update for libpng15 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0901-1 Security update for libpng12-0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0860-1 Security update for libpng12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0853-1 Security update for libpng16 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10972-1 libpng16-16-1.6.37-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-201701-74 vendor-advisory
- USN-3712-1 vendor-advisory
- [oss-security] 20161230 Re: libpng NULL pointer dereference bugfix mailing-list
- 95157 vdb-entry
- USN-3712-2 vendor-advisory
- [oss-security] 20161229 libpng NULL pointer dereference bugfix mailing-list
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list