SUSE-SU-2026:1323-1

Опубликовано: 14 апр. 2026

Источник: suse-cvrf

Описание

Security update for libpng16

This update for libpng16 fixes the following issues:

CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE can lead to arbitrary code execution (bsc#1260754).

Список пакетов

Container suse/sle-micro-rancher/5.2:latest

libpng16-16-1.6.34-150000.3.22.1

Container suse/sle-micro-rancher/5.3:latest

libpng16-16-1.6.34-150000.3.22.1

Container suse/sle-micro-rancher/5.4:latest

libpng16-16-1.6.34-150000.3.22.1

Container suse/sle-micro/base-5.5:latest

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-CHOST-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-CHOST-BYOS-Aliyun

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-CHOST-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-CHOST-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-CHOST-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-CHOST-BYOS-SAP-CCloud

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-HPC-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-HPC-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-HPC-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-HPC-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-HPC-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-HPC-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-Hardened-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-Hardened-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-Hardened-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-Hardened-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-Micro-5-3-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-Micro-5-3-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-Micro-5-4-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-Micro-5-4-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Azure

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Azure-LI-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Azure-LI-BYOS-Production

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Azure-VLI-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-EC2

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-GCE

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Hardened

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Hardened-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Hardened-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Hardened-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Hardened-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Hardened-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAP-Hardened-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP4-SAPCAL

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP4-SAPCAL-Azure

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP4-SAPCAL-EC2

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP4-SAPCAL-GCE

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP5-Azure-3P

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Azure-Basic

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Azure-Standard

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-CHOST-BYOS-Aliyun

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-CHOST-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-CHOST-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-CHOST-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-CHOST-BYOS-GDC

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-CHOST-BYOS-SAP-CCloud

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-HPC-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-HPC-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-HPC-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-HPC-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Hardened-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Hardened-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Hardened-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Micro-5-5

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Micro-5-5-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Micro-5-5-BYOS

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Micro-5-5-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Micro-5-5-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Micro-5-5-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Micro-5-5-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-Micro-5-5-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-Azure-3P

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-Hardened-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-Hardened-BYOS-Azure

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-Hardened-BYOS-EC2

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-Hardened-BYOS-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAP-Hardened-GCE

libpng16-16-1.6.34-150000.3.22.1

Image SLES15-SP5-SAPCAL-Azure

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP5-SAPCAL-EC2

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Image SLES15-SP5-SAPCAL-GCE

libpng16-16-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

libpng16-16-1.6.34-150000.3.22.1

libpng16-16-32bit-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

libpng16-16-1.6.34-150000.3.22.1

libpng16-16-32bit-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

libpng16-16-1.6.34-150000.3.22.1

libpng16-16-32bit-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

libpng16-16-1.6.34-150000.3.22.1

libpng16-16-32bit-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

SUSE Linux Enterprise Micro 5.2

libpng16-16-1.6.34-150000.3.22.1

SUSE Linux Enterprise Micro 5.3

libpng16-16-1.6.34-150000.3.22.1

SUSE Linux Enterprise Micro 5.4

libpng16-16-1.6.34-150000.3.22.1

SUSE Linux Enterprise Micro 5.5

libpng16-16-1.6.34-150000.3.22.1

SUSE Linux Enterprise Server 15 SP4-LTSS

libpng16-16-1.6.34-150000.3.22.1

libpng16-16-32bit-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

SUSE Linux Enterprise Server 15 SP5-LTSS

libpng16-16-1.6.34-150000.3.22.1

libpng16-16-32bit-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

SUSE Linux Enterprise Server for SAP Applications 15 SP4

libpng16-16-1.6.34-150000.3.22.1

libpng16-16-32bit-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

SUSE Linux Enterprise Server for SAP Applications 15 SP5

libpng16-16-1.6.34-150000.3.22.1

libpng16-16-32bit-1.6.34-150000.3.22.1

libpng16-compat-devel-1.6.34-150000.3.22.1

libpng16-devel-1.6.34-150000.3.22.1

Ссылки

https://www.suse.com/support/update/announcement/2026/suse-su-20261323-1/
Link for SUSE-SU-2026:1323-1
https://lists.suse.com/pipermail/sle-updates/2026-April/045524.html
E-Mail link for SUSE-SU-2026:1323-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1260754
SUSE Bug 1260754
https://www.suse.com/security/cve/CVE-2026-33416/
SUSE CVE CVE-2026-33416 page

Описание

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.

Затронутые продукты

Container suse/sle-micro-rancher/5.2:latest:libpng16-16-1.6.34-150000.3.22.1

Container suse/sle-micro-rancher/5.3:latest:libpng16-16-1.6.34-150000.3.22.1

Container suse/sle-micro-rancher/5.4:latest:libpng16-16-1.6.34-150000.3.22.1

Container suse/sle-micro/base-5.5:latest:libpng16-16-1.6.34-150000.3.22.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-33416.html
CVE-2026-33416
https://bugzilla.suse.com/1260754
SUSE Bug 1260754