CVE-2019-7317
At a glance
- Severity
- MEDIUM 5.3
- EPSS
- EPSS 9.39 % · percentile 95 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2019-16860
- GCVE · GCVE-0-2019-7317
CERT-FR advisories
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1103 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-699 — Vulnérabilité dans Foxit Reader · cert.ssi.gouv.fr
- CERTFR-2021-AVI-296 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
- CERTFR-2020-AVI-169 — Multiples vulnérabilités dans IBM SDK, Java Technology Edition · cert.ssi.gouv.fr
- CERTFR-2019-AVI-340 — Multiples vulnérabilités dans Oracle Java SE · cert.ssi.gouv.fr
- CERTFR-2019-AVI-237 — Multiples vulnérabilités dans Mozilla Thunderbird · cert.ssi.gouv.fr
- CERTFR-2019-AVI-236 — Multiples vulnérabilités dans Mozilla Firefox · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*≥ 1.6.0 < 1.6.37cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.6.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:java_se:7u221:*:*:*:*:*:*:*cpe:2.3:a:oracle:java_se:8u212:*:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:11.0.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:jdk:12.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*< 8.0.23cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*< 8.7.0-00cpe:2.3:a:hpe:xp7_command_view_advanced_edition_suite:*:*:*:*:*:*:*:*< 8.7.0-00cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*cpe:2.3:a:opensuse:package_hub:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*< 9.6cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*< 9.6cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:windows:*:*cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:vcenter:*:*cpe:2.3:a:netapp:e-series_santricity_storage_manager:*:*:*:*:*:*:*:*< 11.53cpe:2.3:a:netapp:e-series_santricity_unified_manager:*:*:*:*:*:*:*:*< 3.2cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:*< 4.0cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:*< 7.3.9cpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:*< 5.1cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:*< 3.4.2cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*< 3.4.2cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:oracle:*:*cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:sap:*:*cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:*cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*- +16 more
Affected products
| Product | Versions |
|---|---|
| affected n/a |
References
- https://seclists.org/bugtraq/2019/Apr/30
- https://www.debian.org/security/2019/dsa-4435
- https://seclists.org/bugtraq/2019/Apr/36
- https://usn.ubuntu.com/3962-1/
- https://usn.ubuntu.com/3991-1/
- https://seclists.org/bugtraq/2019/May/56
- https://seclists.org/bugtraq/2019/May/59
- https://www.debian.org/security/2019/dsa-4448
- https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html
- https://access.redhat.com/errata/RHSA-2019:1265
- https://access.redhat.com/errata/RHSA-2019:1267
- https://access.redhat.com/errata/RHSA-2019:1269
- https://www.debian.org/security/2019/dsa-4451
- https://seclists.org/bugtraq/2019/May/67
- https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html
- https://usn.ubuntu.com/3997-1/
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html
- https://access.redhat.com/errata/RHSA-2019:1310
- https://access.redhat.com/errata/RHSA-2019:1308
- https://access.redhat.com/errata/RHSA-2019:1309
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html
- http://www.securityfocus.com/bid/108098
- https://usn.ubuntu.com/4080-1/
- https://usn.ubuntu.com/4083-1/
- https://security.gentoo.org/glsa/201908-02
- https://access.redhat.com/errata/RHSA-2019:2494
- https://access.redhat.com/errata/RHSA-2019:2495
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html
- https://access.redhat.com/errata/RHSA-2019:2585
- https://access.redhat.com/errata/RHSA-2019:2590
- https://access.redhat.com/errata/RHSA-2019:2592
- https://access.redhat.com/errata/RHSA-2019:2737
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803
- https://github.com/glennrp/libpng/issues/275
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html
- https://security.netapp.com/advisory/ntap-20190719-0005/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us
- https://www.oracle.com/security-alerts/cpuoct2021.html
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |