Description
OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | optipng | 0.7.8+ds-1 | — |
| Debian 13 | optipng | 0.7.8+ds-1 | — |
| Debian 12 | optipng | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | optipng | No fix yet | — |
| Ubuntu 20.04 LTS | optipng | No fix yet | — |
| Ubuntu 18.04 LTS | optipng | No fix yet | — |
| Ubuntu 16.04 LTS | optipng | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | optipng | 0.7.8-bp154.3.5.1 | openSUSE-SU-2023:0388-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | optipng | 0.7.8-1.1 | openSUSE-SU-2024:13415-1 |
| openSUSE Leap 15.4 | optipng | 0.7.8-bp154.3.5.1 | openSUSE-SU-2023:0388-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | optipng | 0.7.8-r0 | — |
| Alpine v3.23 | optipng | 0.7.8-r0 | — |
| Alpine v3.22 | optipng | 0.7.8-r0 | — |
| Alpine v3.21 | optipng | 0.7.8-r0 | — |
| Alpine v3.20 | optipng | 0.7.8-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | optipng | 0.7.8-r0 | — |
| Alpine v3.18 | optipng | 0.7.8-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | optipng | 0.7.7-3.amzn2.0.1 | ALAS2-2025-3011 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | optipng | 0.7.8-5 | — |
| Azure Linux 2 (CBL-Mariner) | optipng | No fix yet | — |
Advisories 3
- openSUSE-SU-2024:13415-1 optipng-0.7.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2025-3011 Low: optipng security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 29, 2025
- openSUSE-SU-2023:0388-1 Security update for optipng SUSE / openSUSE Security Updates · May 7, 2025
References
- http://optipng.sourceforge.net/
- https://sourceforge.net/projects/optipng/files/OptiPNG/optipng-0.7.7/optipng-0.7.7.tar.gz/download?use_mirror=udomain&download=
- https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffer-overflow1/optipng-global-buffer-overflow1.md
- FEDORA-2023-f3389245ce vendor-advisory
- FEDORA-2023-ae05c3bca8 vendor-advisory
- FEDORA-2023-125037736c vendor-advisory