CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HCVE-2019-7317
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Severity
- EPSS
- 9.4% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
- CWE
- CWE-416
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- hp:xp7_command_view
- hpe:xp7_command_view_advanced_edition_suite
- libpng:libpng
- mozilla:firefox
- mozilla:thunderbird
- netapp:active_iq_unified_manager
- netapp:cloud_backup
- netapp:e-series_santricity_management
- netapp:e-series_santricity_storage_manager
- netapp:e-series_santricity_unified_manager
- netapp:e-series_santricity_web_services
- netapp:oncommand_insight
- netapp:oncommand_workflow_automation
- netapp:plug-in_for_symantec_netbackup
- netapp:snapmanager
- netapp:steelstore
- opensuse:leap
- opensuse:package_hub
- oracle:hyperion_infrastructure_technology
- oracle:java_se
- oracle:jdk
- oracle:mysql
- redhat:enterprise_linux
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_for_ibm_z_systems
- redhat:enterprise_linux_for_power_big_endian
- redhat:enterprise_linux_for_power_little_endian
- redhat:enterprise_linux_for_scientific_computing
- redhat:enterprise_linux_workstation
- redhat:satellite
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html