Описание
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libpng1.6 | fixed | 1.6.36-4 | package | |
| libpng | removed | package | ||
| libpng | not-affected | jessie | package | |
| firefox | fixed | 67.0-1 | experimental | package |
| firefox | fixed | 67.0-2 | package | |
| firefox-esr | fixed | 60.7.0esr-1 | package | |
| thunderbird | fixed | 1:60.7.0-1 | package |
Примечания
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803
https://github.com/glennrp/libpng/issues/275
https://github.com/glennrp/libpng/commit/9c0d5c77bf5bf2d7c1e11f388de40a70e0191550
https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-7317
https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-7317
https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-7317
Связанные уязвимости
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.