Описание
Security update for libpng16
This update for libpng16 fixes the following issues:
- CVE-2026-33416: use-after-free via pointer aliasing in
png_set_tRNSandpng_set_PLTEcan lead to arbitrary code execution (bsc#1260754). - CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and crashes (bsc#1260755).
Список пакетов
Container bci/openjdk-devel:17
libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk-devel:21
libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk-devel:latest
libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk:17
libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk:21
libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk:latest
libpng16-16-1.6.40-150600.3.17.1
Container private-registry/1.2/harbor-portal:latest
libpng16-16-1.6.40-150600.3.17.1
Container private-registry/harbor-portal:latest
libpng16-16-1.6.40-150600.3.17.1
Container suse/kiosk/firefox-esr:latest
libpng16-16-1.6.40-150600.3.17.1
Container suse/kiosk/pulseaudio:latest
libpng16-16-1.6.40-150600.3.17.1
Container suse/kiosk/xorg-client:latest
libpng16-16-1.6.40-150600.3.17.1
Container suse/kiosk/xorg:latest
libpng16-16-1.6.40-150600.3.17.1
Container suse/manager/5.0/x86_64/server-attestation:latest
libpng16-16-1.6.40-150600.3.17.1
Container suse/manager/5.0/x86_64/server:latest
libpng16-16-1.6.40-150600.3.17.1
Container suse/multi-linux-manager/5.1/x86_64/server-attestation:latest
libpng16-16-1.6.40-150600.3.17.1
Container suse/multi-linux-manager/5.1/x86_64/server:latest
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-Azure-3P
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-Azure-Basic
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-Azure-Standard
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-BYOS
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-CHOST-BYOS
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-CHOST-BYOS-Aliyun
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-CHOST-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-CHOST-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-CHOST-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-CHOST-BYOS-GDC
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-CHOST-BYOS-SAP-CCloud
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-EC2-ECS-HVM
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-HPC
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-HPC-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-HPC-BYOS
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-HPC-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-HPC-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-HPC-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-HPC-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-HPC-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-Hardened-BYOS
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-Hardened-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-Hardened-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-Hardened-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Azure
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Azure-3P
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-BYOS
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-EC2
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-GCE
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Hardened
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Hardened-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Hardened-BYOS
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Hardened-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Hardened-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Hardened-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Hardened-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAP-Hardened-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP6-SAPCAL
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP6-SAPCAL-Azure
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP6-SAPCAL-EC2
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP6-SAPCAL-GCE
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP7-Azure-3P
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-Azure-Basic
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-Azure-Standard
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-CHOST-BYOS-Aliyun
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-CHOST-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-CHOST-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-CHOST-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-CHOST-BYOS-GDC
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-CHOST-BYOS-SAP-CCloud
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-EC2-ECS-HVM
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-GCE-3P
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-HPC-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-HPC-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-HPC-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-HPC-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-Hardened-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-Hardened-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-Hardened-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-Azure-3P
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-GCE-3P
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-Hardened-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-Hardened-BYOS-Azure
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-Hardened-BYOS-EC2
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-Hardened-BYOS-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAP-Hardened-GCE
libpng16-16-1.6.40-150600.3.17.1
Image SLES15-SP7-SAPCAL-Azure
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP7-SAPCAL-EC2
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image SLES15-SP7-SAPCAL-GCE
libpng16-16-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
Image server-attestation-image
libpng16-16-1.6.40-150600.3.17.1
Image server-image-sles15sp7
libpng16-16-1.6.40-150600.3.17.1
SUSE Linux Enterprise Module for Basesystem 15 SP7
libpng16-16-1.6.40-150600.3.17.1
libpng16-16-32bit-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
SUSE Linux Enterprise Server 15 SP6-LTSS
libpng16-16-1.6.40-150600.3.17.1
libpng16-16-32bit-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6
libpng16-16-1.6.40-150600.3.17.1
libpng16-16-32bit-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
openSUSE Leap 15.6
libpng16-16-1.6.40-150600.3.17.1
libpng16-16-32bit-1.6.40-150600.3.17.1
libpng16-compat-devel-1.6.40-150600.3.17.1
libpng16-compat-devel-32bit-1.6.40-150600.3.17.1
libpng16-devel-1.6.40-150600.3.17.1
libpng16-devel-32bit-1.6.40-150600.3.17.1
libpng16-tools-1.6.40-150600.3.17.1
Ссылки
- Link for SUSE-SU-2026:1368-1
- E-Mail link for SUSE-SU-2026:1368-1
- SUSE Security Ratings
- SUSE Bug 1260754
- SUSE Bug 1260755
- SUSE CVE CVE-2026-33416 page
- SUSE CVE CVE-2026-33636 page
Описание
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.
Затронутые продукты
Container bci/openjdk-devel:17:libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk-devel:21:libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk-devel:latest:libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk:17:libpng16-16-1.6.40-150600.3.17.1
Ссылки
- CVE-2026-33416
- SUSE Bug 1260754
Описание
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.
Затронутые продукты
Container bci/openjdk-devel:17:libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk-devel:21:libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk-devel:latest:libpng16-16-1.6.40-150600.3.17.1
Container bci/openjdk:17:libpng16-16-1.6.40-150600.3.17.1
Ссылки
- CVE-2026-33636
- SUSE Bug 1260755