CVE-2019-7317

MEDIUM
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

References

https://github.com/glennrp/libpng/issues/275

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803

https://seclists.org/bugtraq/2019/Apr/30

http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html

https://www.debian.org/security/2019/dsa-4435

https://seclists.org/bugtraq/2019/Apr/36

https://usn.ubuntu.com/3962-1/

https://usn.ubuntu.com/3991-1/

https://seclists.org/bugtraq/2019/May/56

https://seclists.org/bugtraq/2019/May/59

https://www.debian.org/security/2019/dsa-4448

https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html

https://access.redhat.com/errata/RHSA-2019:1265

https://access.redhat.com/errata/RHSA-2019:1269

https://access.redhat.com/errata/RHSA-2019:1267

https://www.debian.org/security/2019/dsa-4451

https://seclists.org/bugtraq/2019/May/67

https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html

https://usn.ubuntu.com/3997-1/

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html

https://access.redhat.com/errata/RHSA-2019:1310

https://access.redhat.com/errata/RHSA-2019:1309

https://access.redhat.com/errata/RHSA-2019:1308

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html

http://www.securityfocus.com/bid/108098

https://security.netapp.com/advisory/ntap-20190719-0005/

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

https://usn.ubuntu.com/4080-1/

https://usn.ubuntu.com/4083-1/

https://security.gentoo.org/glsa/201908-02

https://access.redhat.com/errata/RHSA-2019:2494

https://access.redhat.com/errata/RHSA-2019:2495

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html

https://access.redhat.com/errata/RHSA-2019:2585

https://access.redhat.com/errata/RHSA-2019:2590

https://access.redhat.com/errata/RHSA-2019:2592

https://access.redhat.com/errata/RHSA-2019:2737

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us

https://www.oracle.com/security-alerts/cpuApr2021.html

Details

Source: MITRE

Published: 2019-02-04

Updated: 2021-06-14

Type: CWE-416

Risk Information

CVSS v2

Base Score: 2.6

Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 4.9

Severity: LOW

CVSS v3

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 1.6

Severity: MEDIUM

Tenable Plugins

View all (87 total)

IDNameProductFamilySeverity
150540SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2019:14160-1)NessusSuSE Local Security Checks
medium
145688CentOS 8 : firefox (CESA-2019:1269)NessusCentOS Local Security Checks
critical
145630CentOS 8 : thunderbird (CESA-2019:1308)NessusCentOS Local Security Checks
critical
134278SUSE SLES12 Security Update : libpng16 (SUSE-SU-2019:3060-2)NessusSuSE Local Security Checks
critical
131496EulerOS Virtualization for ARM 64 3.0.3.0 : libpng (EulerOS-SA-2019-2331)NessusHuawei Local Security Checks
medium
131310SUSE SLED12 / SLES12 Security Update : libpng16 (SUSE-SU-2019:3060-1)NessusSuSE Local Security Checks
critical
128872SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2019:2371-1)NessusSuSE Local Security Checks
critical
128858RHEL 6 : java-1.8.0-ibm (RHSA-2019:2737)NessusRed Hat Local Security Checks
critical
128698NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0178)NessusNewStart CGSL Local Security Checks
critical
128691NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2019-0175)NessusNewStart CGSL Local Security Checks
critical
128628SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2019:2336-1)NessusSuSE Local Security Checks
medium
128520SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:2291-1)NessusSuSE Local Security Checks
critical
128451RHEL 6 : java-1.8.0-ibm (RHSA-2019:2592)NessusRed Hat Local Security Checks
critical
128449RHEL 8 : java-1.8.0-ibm (RHSA-2019:2590)NessusRed Hat Local Security Checks
critical
128447RHEL 7 : java-1.8.0-ibm (RHSA-2019:2585)NessusRed Hat Local Security Checks
critical
128008openSUSE Security Update : java-11-openjdk (openSUSE-2019-1916)NessusSuSE Local Security Checks
medium
128004openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-1912)NessusSuSE Local Security Checks
medium
127988RHEL 7 : java-1.7.1-ibm (RHSA-2019:2495)NessusRed Hat Local Security Checks
medium
127987RHEL 6 : java-1.7.1-ibm (RHSA-2019:2494)NessusRed Hat Local Security Checks
medium
127800Ubuntu 18.04 LTS / 19.04 : OpenJDK 11 vulnerabilities (USN-4083-1)NessusUbuntu Local Security Checks
medium
127797Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-4080-1)NessusUbuntu Local Security Checks
medium
127762SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:2036-1)NessusSuSE Local Security Checks
medium
127758SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:2028-1) (Spectre)NessusSuSE Local Security Checks
medium
127757SUSE SLED15 / SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:2021-1)NessusSuSE Local Security Checks
medium
127745SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2019:2002-1)NessusSuSE Local Security Checks
medium
127589Oracle Linux 8 : thunderbird (ELSA-2019-1308)NessusOracle Linux Local Security Checks
critical
127587Oracle Linux 8 : firefox (ELSA-2019-1269)NessusOracle Linux Local Security Checks
critical
127560GLSA-201908-02 : libpng: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
127459NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0169)NessusNewStart CGSL Local Security Checks
critical
127455NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0167)NessusNewStart CGSL Local Security Checks
critical
127439NewStart CGSL CORE 5.04 / MAIN 5.04 : firefox Multiple Vulnerabilities (NS-SA-2019-0159)NessusNewStart CGSL Local Security Checks
critical
127438NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0158)NessusNewStart CGSL Local Security Checks
critical
127305NewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0088)NessusNewStart CGSL Local Security Checks
critical
127304NewStart CGSL CORE 5.05 / MAIN 5.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0087)NessusNewStart CGSL Local Security Checks
critical
127024EulerOS 2.0 SP8 : libpng (EulerOS-SA-2019-1787)NessusHuawei Local Security Checks
medium
126958Amazon Linux 2 : java-11-amazon-corretto (ALAS-2019-1246)NessusAmazon Linux Local Security Checks
medium
126821Oracle Java SE 1.7.0_231 / 1.8.0_221 / 1.11.0_4 / 1.12.0_2 Multiple Vulnerabilities (Jul 2019 CPU)NessusWindows
medium
126820Oracle Java SE 1.7.0_231 / 1.8.0_221 / 1.11.0_4 / 1.12.0_2 Multiple Vulnerabilities (Jul 2019 CPU) (Unix)NessusMisc.
medium
126526SUSE SLED15 / SLES15 Security Update : libpng16 (SUSE-SU-2019:1398-2)NessusSuSE Local Security Checks
medium
125948Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Firefox regression (USN-3991-3)NessusUbuntu Local Security Checks
critical
125901Amazon Linux 2 : thunderbird (ALAS-2019-1229)NessusAmazon Linux Local Security Checks
critical
125809openSUSE Security Update : MozillaFirefox (openSUSE-2019-1534)NessusSuSE Local Security Checks
critical
125803CentOS 6 : thunderbird (CESA-2019:1310)NessusCentOS Local Security Checks
critical
125802CentOS 7 : thunderbird (CESA-2019:1309)NessusCentOS Local Security Checks
critical
125797openSUSE Security Update : libpng16 (openSUSE-2019-1530)NessusSuSE Local Security Checks
medium
125766Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : firefox regression (USN-3991-2)NessusUbuntu Local Security Checks
critical
125716Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190604)NessusScientific Linux Local Security Checks
critical
125715Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190604)NessusScientific Linux Local Security Checks
critical
125702SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2019:1405-1)NessusSuSE Local Security Checks
critical
125692RHEL 6 : thunderbird (RHSA-2019:1310)NessusRed Hat Local Security Checks
critical
125691RHEL 7 : thunderbird (RHSA-2019:1309)NessusRed Hat Local Security Checks
critical
125690RHEL 8 : thunderbird (RHSA-2019:1308)NessusRed Hat Local Security Checks
critical
125689Oracle Linux 6 : thunderbird (ELSA-2019-1310)NessusOracle Linux Local Security Checks
critical
125688Oracle Linux 7 : thunderbird (ELSA-2019-1309)NessusOracle Linux Local Security Checks
critical
125677SUSE SLED15 / SLES15 Security Update : libpng16 (SUSE-SU-2019:1398-1)NessusSuSE Local Security Checks
medium
125672SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:1388-1)NessusSuSE Local Security Checks
critical
125669openSUSE Security Update : MozillaThunderbird (openSUSE-2019-1484)NessusSuSE Local Security Checks
critical
125554CentOS 6 : firefox (CESA-2019:1267)NessusCentOS Local Security Checks
critical
125553CentOS 7 : firefox (CESA-2019:1265)NessusCentOS Local Security Checks
critical
125545Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Thunderbird vulnerabilities (USN-3997-1)NessusUbuntu Local Security Checks
critical
125449Scientific Linux Security Update : firefox on SL7.x x86_64 (20190524)NessusScientific Linux Local Security Checks
critical
125447Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20190523)NessusScientific Linux Local Security Checks
critical
125444Oracle Linux 6 : firefox (ELSA-2019-1267)NessusOracle Linux Local Security Checks
critical
125443Oracle Linux 7 : firefox (ELSA-2019-1265)NessusOracle Linux Local Security Checks
critical
125415Debian DSA-4451-1 : thunderbird - security updateNessusDebian Local Security Checks
critical
125412Debian DLA-1806-1 : thunderbird security updateNessusDebian Local Security Checks
critical
125395Photon OS 2.0: Libpng PHSA-2019-2.0-0160NessusPhotonOS Local Security Checks
high
125385RHEL 8 : firefox (RHSA-2019:1269)NessusRed Hat Local Security Checks
critical
125383RHEL 6 : firefox (RHSA-2019:1267)NessusRed Hat Local Security Checks
critical
125382RHEL 7 : firefox (RHSA-2019:1265)NessusRed Hat Local Security Checks
critical
125374Debian DLA-1800-1 : firefox-esr security updateNessusDebian Local Security Checks
critical
125363Mozilla Firefox ESR < 60.7NessusWindows
critical
125362Mozilla Firefox ESR < 60.7NessusMacOS X Local Security Checks
critical
125361Mozilla Firefox < 67.0NessusWindows
critical
125360Mozilla Firefox < 67.0NessusMacOS X Local Security Checks
critical
125359Mozilla Thunderbird < 60.7NessusWindows
critical
125358Mozilla Thunderbird < 60.7NessusMacOS X Local Security Checks
critical
125346FreeBSD : mozilla -- multiple vulnerabilities (44b6dfbf-4ef7-4d52-ad52-2b1b05d81272)NessusFreeBSD Local Security Checks
critical
125343Debian DSA-4448-1 : firefox-esr - security updateNessusDebian Local Security Checks
critical
125339Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Firefox vulnerabilities (USN-3991-1)NessusUbuntu Local Security Checks
critical
700733Mozilla Firefox ESR < 60.7 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
700727Mozilla Firefox < 67.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
124458Ubuntu 18.04 LTS / 18.10 : libpng vulnerability (USN-3962-1)NessusUbuntu Local Security Checks
medium
124344Debian DSA-4435-1 : libpng1.6 - security updateNessusDebian Local Security Checks
medium
124140Slackware 14.2 / current : libpng (SSA:2019-107-01)NessusSlackware Local Security Checks
high
122105Fedora 29 : 2:libpng (2019-335c3ad86a)NessusFedora Local Security Checks
medium
700742Mozilla Thunderbird < 60.7 Multiple VulnerabilitiesNessus Network MonitorSMTP Clients
high