CVE-2019-7317
MEDIUM severity · CVSS 5.3 · Use-after-free
5.3CVSS MEDIUM
Summary
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Impact & exploitability
Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionRequired
Confidentiality impactNone
Integrity impactNone
Availability impactHigh
Exploit probability (EPSS)1%
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products we track (4)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.htmlAdvisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.htmlAdvisory
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.htmlAdvisory
- http://www.securityfocus.com/bid/108098Advisory
- https://access.redhat.com/errata/RHSA-2019:1265Advisory