VulnerabilityModified
CVE-2019-7317
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
MEDIUM 5.3EPSS 9.39%
Does this matter?
Lower severity and a low EPSS score (9.39%). Track it; it rarely justifies an emergency change on its own.
Description
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- EPSS
- 9.39% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- libpng/libpng · debian/debian linux · canonical/ubuntu linux · oracle/hyperion infrastructure technology · oracle/java se · oracle/jdk · oracle/mysql · hp/xp7 command view · hpe/xp7 command view advanced edition suite · mozilla/firefox · mozilla/thunderbird · opensuse/leap · opensuse/package hub · netapp/active iq unified manager · netapp/cloud backup · netapp/e-series santricity management · netapp/e-series santricity storage manager · netapp/e-series santricity unified manager · netapp/e-series santricity web services · netapp/oncommand insight · +12 more
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.htmlMailing List, Third Party Advisory
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.htmlThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/108098Not Applicable, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:1265Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1267Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1269Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1308Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1309Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1310Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2494Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2495Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2585Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2590Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2592Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2737Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803Issue Tracking, Mailing List, Third Party Advisory
- https://github.com/glennrp/libpng/issues/275Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00032.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00038.htmlMailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Apr/30Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Apr/36Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/56Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/59Issue Tracking, Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/May/67Issue Tracking, Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201908-02Third Party Advisory
- https://security.netapp.com/advisory/ntap-20190719-0005/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.