Description
In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libpng1.6 | 1.6.34-2 | — |
| Debian 13 | libpng1.6 | 1.6.34-2 | — |
| Debian 12 | libpng1.6 | 1.6.34-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libpng1.6 | 1.6.34-1ubuntu0.18.04.1 | USN-3712-1 |
| Ubuntu 16.04 LTS | libpng | 1.2.54-1ubuntu1.1 | USN-3712-1 |
| Ubuntu 14.04 LTS | libpng | 1.2.50-1ubuntu2.14.04.3 | USN-3712-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | java-1.7.1-ibm +5 | 1:1.7.1.4.35-1jpp.1.el7 | RHSA-2018:3672 |
| RHEL 7 | java-1.8.0-ibm +5 | 1:1.8.0.5.25-1jpp.1.el7 | RHSA-2018:3534 |
| RHEL 6 | java-1.7.1-ibm +5 | 1:1.7.1.4.35-1jpp.1.el6_10 | RHSA-2018:3671 |
| RHEL 6 | java-1.8.0-ibm +5 | 1:1.8.0.5.25-1jpp.1.el6_10 | RHSA-2018:3533 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Oracle Java 7 | java-1.6.0-sun +5 | 1:1.6.0.211-1jpp.1.el7 | RHSA-2018:3007 |
| Red Hat Rhel Extras Oracle Java 7 | java-1.7.0-oracle +5 | 1:1.7.0.201-1jpp.1.el7 | RHSA-2018:3001 |
| Red Hat Rhel Extras Oracle Java 7 | java-1.8.0-oracle +5 | 1:1.8.0.191-1jpp.1.el7 | RHSA-2018:3002 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.6.0-sun +5 | 1:1.6.0.211-1jpp.1.el6 | RHSA-2018:3008 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.7.0-oracle +5 | 1:1.7.0.201-1jpp.1.el6 | RHSA-2018:3000 |
| Red Hat Rhel Extras Oracle Java 6 | java-1.8.0-oracle +5 | 1:1.8.0.191-1jpp.1.el6 | RHSA-2018:3003 |
| Red Hat Network Satellite 5 | java-1.7.1-ibm +1 | 1:1.7.1.4.35-1jpp.1.el6_10 | RHSA-2018:3779 |
| Red Hat Network Satellite 5 | java-1.8.0-ibm +1 | 1:1.8.0.5.25-1jpp.1.el6_10 | RHSA-2018:3852 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | libpng16 | 1.6.34-3.9.1 | SUSE-SU-2019:1398-2 |
| SLES 15 | java-1_8_0-ibm | 1.8.0_sr5.25-3.9.1 | SUSE-SU-2018:3868-1 |
| SLES 15 | java-1_8_0-openjdk | 1.8.0.191-3.13.1 | SUSE-SU-2019:0058-1 |
| SLES 15 | libpng16 | 1.6.34-3.9.1 | SUSE-SU-2019:1398-1 |
| SLES 12 SP4 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SLES 12 SP4 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SLES 12 SP4 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SLES 12 SP4 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
| SLES 12 SP3 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SLES 12 SP3 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SLES 12 SP3 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SLES 12 SP3 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
| SLES 12 SP2 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SLES 12 SP2 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SLES 12 SP2 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SLES 12 SP2 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SLES 12 SP1 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SLES 12 SP1 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SLES 12 SP1 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
| SLES 12 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SLES 12 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SLES 11 SP4 | java-1_7_1-ibm | 1.7.1_sr4.35-26.32.1 | SUSE-SU-2018:3921-1 |
| SLES 11 SP3 | java-1_7_0-ibm | 1.7.0_sr10.35-65.31.1 | SUSE-SU-2018:3920-1 |
| SLES for SAP 12 SP4 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SLES for SAP 12 SP4 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SLES for SAP 12 SP4 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SLES for SAP 12 SP4 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
| SLES for SAP 12 SP3 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SLES for SAP 12 SP3 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SLES for SAP 12 SP3 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SLES for SAP 12 SP3 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
| SLES for SAP 12 SP2 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SLES for SAP 12 SP2 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SLES for SAP 12 SP2 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SLES for SAP 12 SP2 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
| SLES for SAP 12 SP1 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-2 |
| SLES for SAP 12 SP1 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-2 |
| SLES for SAP 12 SP1 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-2 |
| SLES for SAP 12 SP1 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-2 |
| SLES for SAP 11 SP4 | java-1_7_1-ibm | 1.7.1_sr4.35-26.32.1 | SUSE-SU-2018:3921-1 |
| SUSE OpenStack Cloud 7 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SUSE OpenStack Cloud 7 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SUSE OpenStack Cloud 7 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SUSE OpenStack Cloud 7 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | java-1_7_0-ibm | 1.7.0_sr10.35-65.31.1 | SUSE-SU-2018:3920-1 |
| SUSE Enterprise Storage 4 | java-1_7_0-openjdk | 1.7.0.201-43.18.1 | SUSE-SU-2019:0049-1 |
| SUSE Enterprise Storage 4 | java-1_7_1-ibm | 1.7.1_sr4.35-38.29.1 | SUSE-SU-2018:3933-1 |
| SUSE Enterprise Storage 4 | java-1_8_0-ibm | 1.8.0_sr5.25-30.39.1 | SUSE-SU-2018:4064-1 |
| SUSE Enterprise Storage 4 | java-1_8_0-openjdk | 1.8.0.191-27.29.1 | SUSE-SU-2019:0057-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | java-1_8_0-openjdk | 1.8.0.302-2.2 | openSUSE-SU-2024:10876-1 |
| openSUSE Tumbleweed | libpng16 | 1.6.37-3.3 | openSUSE-SU-2024:10972-1 |
| openSUSE Leap 15.1 | libpng16 | 1.6.34-lp151.3.3.1 | openSUSE-SU-2019:1530-1 |
| openSUSE Leap 15.0 | java-1_8_0-openjdk | 1.8.0.191-lp150.2.9.2 | openSUSE-SU-2019:0043-1 |
| openSUSE Leap 15.0 | libpng16 | 1.6.34-lp151.3.3.1 | openSUSE-SU-2019:1530-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.23 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.22 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.21 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.20 | openjdk8 | 8.191.12-r0 | — |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.18 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.18 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.17 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.17 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.16 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.16 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.15 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.15 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.14 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.14 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.13 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.13 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.12 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.12 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.11 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.11 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.10 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.10 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.9 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.9 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.8 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.8 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.7 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.7 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.6 | openjdk7 | 7.201.2.6.16-r0 | — |
| Alpine v3.6 | openjdk8 | 8.191.12-r0 | — |
| Alpine v3.5 | openjdk8 | 8.191.12-r0 | — |
Advisories 31
- RHSA-2018:3779 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3852 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3671 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3672 Red Hat Security Advisory: java-1.7.1-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3534 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3533 Red Hat Security Advisory: java-1.8.0-ibm security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3007 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3008 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3003 Red Hat Security Advisory: java-1.8.0-oracle security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3001 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3002 Red Hat Security Advisory: java-1.8.0-oracle security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- RHSA-2018:3000 Red Hat Security Advisory: java-1.7.0-oracle security update Red Hat Security Advisories (RHSA) · Aug 27, 2026
- USN-3712-1 libpng, libpng1.6 vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- SUSE-SU-2019:1398-2 Security update for libpng16 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0058-1 Security update for java-1_8_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10876-1 java-1_8_0-openjdk-1.8.0.302-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3933-2 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3868-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3920-1 Security update for java-1_7_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0057-1 Security update for java-1_8_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:4064-2 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0049-1 Security update for java-1_7_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:1530-1 Security update for libpng16 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3921-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10972-1 libpng16-16-1.6.37-3.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0057-2 Security update for java-1_8_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:4064-1 Security update for java-1_8_0-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1398-1 Security update for libpng16 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:0043-1 Security update for java-1_8_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0049-2 Security update for java-1_7_0-openjdk SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3933-1 Security update for java-1_7_1-ibm SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2018:3007 vendor-advisory
- https://security.netapp.com/advisory/ntap-20181018-0001/
- RHSA-2018:3779 vendor-advisory
- RHSA-2018:3534 vendor-advisory
- RHSA-2018:3003 vendor-advisory
- USN-3712-1 vendor-advisory
- RHSA-2018:3002 vendor-advisory
- https://sourceforge.net/p/libpng/bugs/278/
- RHSA-2018:3671 vendor-advisory
- RHSA-2018:3852 vendor-advisory
- RHSA-2018:3008 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- RHSA-2018:3533 vendor-advisory
- RHSA-2018:3001 vendor-advisory
- RHSA-2018:3000 vendor-advisory
- 105599 vdb-entry
- 1041889 vdb-entry
- RHSA-2018:3672 vendor-advisory
- https://github.com/glennrp/libpng/commit/8a05766cb74af05c04c53e6c9d60c13fc4d59bf2
- GLSA-201908-10 vendor-advisory