#22426 closed enhancement (fixed)
libpng-1.6.51
| Reported by: | zeckma | Owned by: | zeckma |
|---|---|---|---|
| Priority: | high | Milestone: | 13.0 |
| Component: | BOOK | Version: | git |
| Severity: | medium | Keywords: | |
| Cc: |
Description (last modified by )
Fixes four CVEs (2 high, 2 moderate).
- CVE-2025-64505 (CVSS 6.1, Moderate): Heap buffer over-read in png_do_quantize via malformed palette index.
- CVE-2025-64506 (CVSS 6.1, Moderate): Heap buffer over-read in png_write_image_8bit with 8-bit input and convert_to_8bit enabled.
- CVE-2025-64720 (CVSS 7.1, High): Out-of-bounds read in png_image_read_composite via palette premultiplication with PNG_FLAG_OPTIMIZE_ALPHA.
- CVE-2025-65018 (CVSS 7.1, High): Heap buffer overflow in png_combine_row triggered via png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format.
All four require interaction from the user, processing a PNG image. These CVEs can result in information disclosure, denial of service, and arbitrary code execution (ACE).
Change History (6)
comment:1 by , 11 months ago
| Description: | modified (diff) |
|---|
comment:2 by , 11 months ago
| Summary: | libpng: 1.6.51 → libpng-1.6.51 |
|---|
comment:3 by , 11 months ago
comment:4 by , 11 months ago
Fixed at e73cdbf4642cbc9e25247850940e13c5145b420f. Keeping open for SA issuing, I'll handle it.
Note:
See TracTickets
for help on using tickets.
Updating to libpng-1.6.51-apng.patch.gz.