libpng

Packages Details Patrick Keshishian discovered that libpng incorrectly handled certain text chunks. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10087) It was discovered that libpng incorrectly handled certain malformed images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14048) It was discovered that libpng incorrectly handled memory when freeing certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2019-7317) It was discovered that libpng incorrectly handled memory when processing certain images. An attacker could possibly use this issue to cause a denial of service, or execute... Patrick Keshishian discovered that libpng incorrectly handled certain text chunks. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10087) It was discovered that libpng incorrectly handled certain malformed images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14048) It was discovered that libpng incorrectly handled memory when freeing certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2019-7317) It was discovered that libpng incorrectly handled memory when processing certain images. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-33416) It was discovered that libpng incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-33636) It was discovered that libpng incorrectly handled memory when processing certain images. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-34757) Seung Min Shin discovered that libpng incorrectly handled certain animated images. An attacker could possibly use this issue to cause libpng to misinterpret image data. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2026-40930) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Apple on Tuesday rolled out a fresh wave of security updates to resolve more than 80 vulnerabilities across its mobile and desktop operating systems. iOS 26.4 and iPadOS 26.4 were released for the latest generation iPhone and iPad devices with patches for nearly 40 security defects. WebKit received fixes for eight bugs that could be exploited by malicious websites to bypass policy enforcement, mount XSS attacks, fingerprint users, escape the sandbox, or crash the process. Issues addressed in the kernel could be exploited to disclose kernel memory, leak sensitive kernel state, corrupt kernel memory, or write kernel memory. Vulnerabilities resolved in other components may lead to network traffic interception, access to biometrics-gated Protected Apps, process crashes, app termination, denial-of-service (DoS), installed apps enumeration, sandbox escape, and access to sensitive information. Patches for roughly two dozen of these security defects were delivered to users of older devices as part of the iOS 18.7.7 and iPadOS 18.7.7 security updates. On Tuesday, Apple also rolled out macOS Tahoe 26.4 with fixes for over 75 bugs, including roughly 30 flaws that were addressed with the iOS 26.4 and iPadOS 26.4 updates. The patches target issues in dozens of native components, but also vulnerabilities in third-party open source dependencies, including multiple Apache libraries, Curl, and LibPNG. Additionally, Apple released macOS Sequoia 15.7.5 and macOS Sonoma 14.8.5 with patches for over 50 of these vulnerabilities each. While tvOS 26.4 and watchOS 26.4 were rolled out with fixes for over a dozen vulnerabilities each, visionOS 26.4 is bringing patches for nearly 30 bugs to its users. On Tuesday, Apple also announced the release of Safari 26.4 with fixes for the eight WebKit bugs. Xcode 26.4 was rolled out with patches for two flaws. Apple makes no mention of any of these security defects being exploited in the wild. Additional information on the updates can be found on the company’s security advisories page. Related: Apple Debuts Background Security Improvements With Fresh WebKit Patches Related: Apple Updates Legacy iOS Versions to Patch Coruna Exploits Related: Apple iPhone and iPad Cleared for Classified NATO Use Related: Apple Patches iOS Zero-Day Exploited in ‘Extremely Sophisticated Attack’

Details It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial transparency and gamma correction. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2025-66293) Petr Simecek, Stanislav Fort and Pavel Kohout discovered that the libpng simplified API incorrectly processed interlaced 16-bit PNGs with 8-bit output format and non-minimal row strides. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2026-22695) Cosmin Truta discovered that the libpng simplified API incorrectly handled invalid row strides. If a user or automated system were tricked... It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial transparency and gamma correction. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2025-66293) Petr Simecek, Stanislav Fort and Pavel Kohout discovered that the libpng simplified API incorrectly processed interlaced 16-bit PNGs with 8-bit output format and non-minimal row strides. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2026-22695) Cosmin Truta discovered that the libpng simplified API incorrectly handled invalid row strides. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-22801) It was discovered that the libpng simplified API incorrectly handled quantizing RGB images. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2026-25646) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Details It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial transparency and gamma correction. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2025-66293) Petr Simecek, Stanislav Fort and Pavel Kohout discovered that the libpng simplified API incorrectly processed interlaced 16-bit PNGs with 8-bit output format and non-minimal row strides. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2026-22695) Cosmin Truta discovered that the libpng simplified API incorrectly handled invalid row strides. If a user or automated system were tricked... It was discovered that the libpng simplified API incorrectly processed palette PNG images with partial transparency and gamma correction. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2025-66293) Petr Simecek, Stanislav Fort and Pavel Kohout discovered that the libpng simplified API incorrectly processed interlaced 16-bit PNGs with 8-bit output format and non-minimal row strides. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2026-22695) Cosmin Truta discovered that the libpng simplified API incorrectly handled invalid row strides. If a user or automated system were tricked into opening a specially crafted PNG file, an attacker could use this issue to cause libpng to crash, resulting in a denial of service. (CVE-2026-22801) The problem can be corrected by updating your system to the following package versions: Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Disponibili PoC per lo sfruttamento di due vulnerabilità nella libreria libpng Alert AL02/251124/CSIRT-ITA Sintesi Disponibili Proof of Concept (PoC) per lo sfruttamento delle CVE-2025-64720 e CVE-2025-65018 – corrette nei commit presenti nella sezione Riferimenti – relative a libpng, libreria open source utilizzata per la lettura e scrittura di file PNG (Portable Network Graphics). Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malevolo di eseguire codice arbitrario, di accedere ad informazioni sensibili o di causare un’interruzione del servizio sui sistemi target. Tipologia Arbitrary Code Execution Information Disclosure Denial of Service Prodotti e versioni affette libpng 1.6.x, versioni precedenti alla 1.6.51 Azioni di mitigazione Ove non provveduto, si raccomanda di aggiornare tempestivamente le release vulnerabili all’ultima versione stabile disponibile.