DSA-4435: -1 libpng1.6 -- security update

Published Apr 27, 2019

Updated

A use-after-free vulnerability was discovered in the pngimagefree() function in the libpng PNG library, which could lead to denial of service or potentially the execution of arbitrary code if a malformed image is processed.

Affected Software

2 affected components

debian/libpng1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libpng1.6 to a version that resolves this vulnerability.
Patch DSA-4435-1

Event History

Apr 27, 2019

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2019-7317

Frequently Asked Questions

What must an attacker do to trigger this issue?

A malformed PNG image must be processed by the affected libpng function, png_image_free().