Vulnerability identifier: #VU17708

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-7317

CWE-ID: CWE-416

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
libpng
Universal components / Libraries / Libraries used by multiple products

Vendor: libpng

Description

The vulnerability allows a remote attacker to cause DoS condition.

The vulnerability exists due to a use-after-free memory error in the png_image_free function, as defined in the png.c source code file when calling on png_safe_execute. A remote attacker can send specially crafted data, trigger a call on png_safe_execute and trigger memory corruption, resulting in a DoS condition.

Mitigation
Update to the latest version.

Vulnerable software versions

libpng: 1.6.36

---

CPE

• cpe:2.3:a:libpng:libpng:1.6.36:*:*:*:*:*:*:*

External links
http://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803
http://github.com/glennrp/libpng/issues/275

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?