NetSight
IP …
medium5.3

CVE-2019-7317

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Impact

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Affected products

VendorProductAffected versions
LibpngLibpng
from 1.6.0 before 1.6.37
DebianDebian Linux
Versions 8.0, 9.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 18.10, 19.04
OracleHyperion Infrastructure Technology
Version 11.2.6.0
OracleJava Se
Versions 7u221, 8u212
OracleJdk
Versions 11.0.3, 12.0.1
OracleMysql
before 8.0.23
HpXp7 Command View
before 8.7.0-00
HpeXp7 Command View Advanced Edition Suite
before 8.7.0-00
MozillaFirefox
All versions
MozillaThunderbird
All versions
OpensuseLeap
Versions 15.0, 15.1, 42.3

Weakness classification

CWE-416

References