CVE-2019-7317 — Use After Free in Libpng

CWE-416 — Use After FreeCWE-400 — Uncontrolled Resource Consumption27 documents10 sources
Severity
5.3MEDIUMNVD
EPSS
0.6%
top 31.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
26
Mozilla ThunderbirdHP XP7 Command ViewHPE XP7 Command View Advanced Edition Suite+23 more
Timeline
PublishedFeb 4
Latest updateJan 15

Description

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.6 | Impact: 3.6

Affected Packages19 packages

▶NVDlibpng/libpng1.6.0 — 1.6.37
▶Debianmozilla/thunderbird< 1:60.7.0-1+3
▶NVDoracle/mysql< 8.0.23
▶NVDnetapp/snapmanager< 3.4.2+1
▶NVDhp/xp7_command_view< 8.7.0-00

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 16.04, 18.04, 18.10, 19.04, Enterprise Linux 6.0, 7.0, 8.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

6
GHSA
GHSA-m96g-x499-p5f9: png_image_free in png↗2022-04-30
▶
OSV
firefox regression↗2019-06-06
▶
OSV
thunderbird vulnerabilities↗2019-05-28
▶
OSV
firefox vulnerabilities↗2019-05-21
▶
CVEList
CVE-2019-7317: png_image_free in png↗2019-02-04
▶

📋Vendor Advisories

11
Oracle
Oracle Oracle Supply Chain Risk Matrix: Security (libpng) — CVE-2019-7317↗2023-01-15
▶
Oracle
Oracle Oracle Hyperion Risk Matrix: Installation and Configuration (libpng) — CVE-2019-7317↗2021-10-15
▶
Oracle
Oracle Oracle MySQL Risk Matrix: Workbench (libpng) — CVE-2019-7317↗2021-04-15
▶
Ubuntu
OpenJDK 8 vulnerabilities↗2019-07-31
▶
Ubuntu
OpenJDK 11 vulnerabilities↗2019-07-31
▶

💬Community

9
Bugzilla
libpng use-after-free in png_image_free↗2019-04-08
▶
Bugzilla
CVE-2019-7317 libpng: use-after-free in png_image_free in png.c↗2019-02-04
▶
Bugzilla
CVE-2019-7317 mingw-libpng: libpng: use-after-free in png_image_free in png.c [epel-7]↗2019-02-04
▶
Bugzilla
CVE-2019-7317 libpng: use-after-free in png_image_free in png.c [fedora-all]↗2019-02-04
▶
Bugzilla
CVE-2019-7317 libpng15: libpng: use-after-free in png_image_free in png.c [fedora-all]↗2019-02-04
▶
CVE-2019-7317 — Use After Free in Libpng | cvebase