CVE-2019-7317
Medium
Description
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Libpng
PublishedFeb 4, 2019
First seenFeb 4, 2019
Weakness typeCWE-416Use after free
How to fix
Update
- libpng libpng1.6.37 or later
- oracle mysql8.0.23 or later
- hp xp7_command_view8.7.0-00 or later
- hpe xp7_command_view_advanced_edition_suite8.7.0-00 or later
- netapp active_iq_unified_manager9.6 or later
- netapp e-series_santricity_storage_manager11.53 or later
- netapp e-series_santricity_unified_manager3.2 or later
- netapp e-series_santricity_web_services4.0 or later
- netapp oncommand_insight7.3.9 or later
- netapp oncommand_workflow_automation5.1 or later
- netapp snapmanager3.4.2 or later
Vendor advisories
- debian.org/security/2019/dsa-4435
- usn.ubuntu.com/3962-1/
- usn.ubuntu.com/3991-1/
- debian.org/security/2019/dsa-4448
- access.redhat.com/errata/RHSA-2019:1265
- access.redhat.com/errata/RHSA-2019:1267
- access.redhat.com/errata/RHSA-2019:1269
- debian.org/security/2019/dsa-4451
- usn.ubuntu.com/3997-1/
- access.redhat.com/errata/RHSA-2019:1310
- access.redhat.com/errata/RHSA-2019:1308
- access.redhat.com/errata/RHSA-2019:1309
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libpng libpng | 1.6.0 ≤ v < 1.6.37 | 1.6.37 |
| debian debian_linux | 8.0, 9.0 | — |
| canonical ubuntu_linux | 16.04, 18.04, 18.10, 19.04 | — |
| oracle hyperion_infrastructure_technology | 11.2.6.0 | — |
| oracle java_se | 7u221, 8u212 | — |
| oracle jdk | 11.0.3, 12.0.1 | — |
| oracle mysql | v < 8.0.23 | 8.0.23 |
| hp xp7_command_view | v < 8.7.0-00 | 8.7.0-00 |
| hpe xp7_command_view_advanced_edition_suite | v < 8.7.0-00 | 8.7.0-00 |
| mozilla firefox | No range specified | — |
| mozilla thunderbird | No range specified | — |
| opensuse leap | 15.0, 15.1, 42.3 | — |
| opensuse package_hub | No range specified | — |
| netapp active_iq_unified_manager | v < 9.6, 9.6 | 9.6 |
| netapp cloud_backup | No range specified | — |
| netapp e-series_santricity_management | No range specified | — |
| netapp e-series_santricity_storage_manager | v < 11.53 | 11.53 |
| netapp e-series_santricity_unified_manager | v < 3.2 | 3.2 |
| netapp e-series_santricity_web_services | v < 4.0 | 4.0 |
| netapp oncommand_insight | v < 7.3.9 | 7.3.9 |
| netapp oncommand_workflow_automation | v < 5.1 | 5.1 |
| netapp plug-in_for_symantec_netbackup | No range specified | — |
| netapp snapmanager | v < 3.4.2, 3.4.2 | 3.4.2 |
| netapp steelstore | No range specified | — |
| redhat satellite | 5.8 | — |
| redhat enterprise_linux | 6.0, 7.0, 8.0 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_for_ibm_z_systems | 6.0, 7.0, 8.0 | — |
| redhat enterprise_linux_for_power_big_endian | 6.0, 7.0 | — |
| redhat enterprise_linux_for_power_little_endian | 7.0, 8.0 | — |
| redhat enterprise_linux_for_scientific_computing | 6.0, 7.0 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.