Skip to content
Fencer Vulns
medium 5.3

CVE-2019-7317 json

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

published 2019-02-04 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16860

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
9.4%
EPSS 9.4% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Patch / fix

  • libpng libpng 1.6.37
  • oracle mysql 8.0.23
  • oracle mysql_server 8.0.23
  • oracle java_se 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • oracle jdk 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • oracle jre 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • sun java 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • sun java_se 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • sun jdk 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • sun jre 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • oracle openjdk 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • sun openjdk 1.7.0_231, 1.8.0_221, 7.0.231, 8.0.221, 11.0.4, 12.0.2
  • mozilla firefox 60.7, 67
  • mozilla firefox_esr 60.7, 67
  • mozilla thunderbird 60.7
  • libpng1.6 Debian 14, Debian 13, Debian 12 1.6.36-4
  • firefox-esr Debian 14, Debian 13, Debian 12 60.7.0esr-1
  • thunderbird Debian 14, Debian 13, Debian 12 1:60.7.0-1

debian advisories DEBIAN-CVE-2019-7317

  • firefox Ubuntu 16.04 LTS 67.0+build2-0ubuntu0.16.04.1
  • firefox Ubuntu 18.04 LTS 67.0+build2-0ubuntu0.18.04.1
  • libpng1.6 Ubuntu 18.04 LTS 1.6.34-1ubuntu0.18.04.2
  • openjdk-8 Ubuntu 16.04 LTS 8u222-b10-1ubuntu1~16.04.1
  • openjdk-8 Ubuntu 18.04 LTS 8u222-b10-1ubuntu1~18.04.1
  • openjdk-lts Ubuntu 18.04 LTS 11.0.4+11-1ubuntu2~18.04.3
  • thunderbird Ubuntu 16.04 LTS 1:60.7.0+build1-0ubuntu0.16.04.1
  • thunderbird Ubuntu 18.04 LTS 1:60.7.0+build1-0ubuntu0.18.04.1

ubuntu advisories UBUNTU-CVE-2019-7317

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • thunderbird RHEL 6 60.7.0-1.el6_10
  • thunderbird RHEL 7 60.7.0-1.el7_6
  • thunderbird RHEL 8 60.7.0-1.el8_0
  • firefox RHEL 6 60.7.0-1.el6_10
  • firefox RHEL 7 60.7.0-1.el7_6
  • firefox RHEL 8 60.7.0-1.el8_0
  • java-1.7.1-ibm RHEL 6 EXTRAS 1:1.7.1.4.50-1jpp.1.el6_10
  • java-1.7.1-ibm-src RHEL 6 EXTRAS 1:1.7.1.4.50-1jpp.1.el6_10

red hat advisories RHSA-2019:1310RHSA-2019:1309RHSA-2019:1308RHSA-2019:1267RHSA-2019:1265RHSA-2019:1269

  • libpng16 SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for SAP 12 SP1 +8 more 1.6.8-15.5.2
  • java-1_7_0-ibm SLE Point of Sale 11 SP3 1.7.0_sr10.50-65.42.1
  • java-1_8_0-ibm SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +17 more 1.8.0_sr5.40-30.54.1
  • java-1_7_1-ibm SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +17 more 1.7.1_sr4.50-38.41.1
  • java-1_8_0-ibm SLE Module for Legacy 15 SP1, SLE Module for Legacy 15 1.8.0_sr5.40-3.24.1
  • java-1_8_0-openjdk SLES 12 SP4, SLES 12 SP3-BCL, SLES 12 SP2-BCL +14 more 1.8.0.222-27.35.2
  • java-1_7_0-openjdk SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 1.7.0.231-43.27.2
  • java-1_8_0-openjdk SLE Module for Package Hub 15, SLE Module for Legacy 15 SP1, SLE Module for Legacy 15 1.8.0.222-3.24.2

suse advisories SUSE-SU-2019:3060-2SUSE-SU-2019:14188-1SUSE-SU-2019:2371-1SUSE-SU-2019:2336-1SUSE-SU-2019:2291-1SUSE-SU-2019:14160-1

  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaFirefox openSUSE Tumbleweed 92.0-1.2
  • MozillaThunderbird openSUSE Tumbleweed 91.1.1-1.1
  • java-11-openjdk openSUSE Tumbleweed 11.0.12.0-3.1
  • java-13-openjdk openSUSE Tumbleweed 13.0.8.0-3.1
  • java-1_8_0-openjdk openSUSE Tumbleweed 1.8.0.302-2.2
  • libpng16 openSUSE Tumbleweed 1.6.37-3.3
  • java-11-openjdk openSUSE Leap 15.1, openSUSE Leap 15.0 11.0.4.0-lp151.3.6.1

opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1openSUSE-SU-2024:10601-1openSUSE-SU-2024:10871-1openSUSE-SU-2024:10872-1openSUSE-SU-2024:10876-1

  • libpng Alpine 3.24, Alpine 3.23, Alpine 3.22 +16 more 1.6.37-r0
  • openjdk8 Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 8.222.10-r0
  • openjdk11 Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 11.0.4_p11-r0
  • firefox-esr Alpine 3.23, Alpine 3.22, Alpine 3.21 +12 more 60.7.0-r0

alpine advisories ALPINE-CVE-2019-7317

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • fltk Azure Linux 3.0 1.3.8-1

azure linux advisories AZL-45210

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • libpng Arch Linux 1.6.37-1
  • thunderbird Arch Linux 60.7.0-1
  • firefox Arch Linux 67.0-1

arch linux advisories AVG-868AVG-965AVG-966

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-7317 updated cvss 5.3

libpng: use-after-free in png_image_free in png.c

  • Red Hat Enterprise Linux 8 libpng, mingw-libpng, mingw32-libpng, mingw64-libpng
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 8 Supplementary java-1.8.0-ibm 1.8.0.5.40-3.el8_0, java-1.8.0-ibm-src 1.8.0.5.40-3.el8_0, java-1.8.0-ibm-demo 1.8.0.5.40-3.el8_0, java-1.8.0-ibm-jdbc 1.8.0.5.40-3.el8_0, java-1.8.0-ibm-plugin 1.8.0.5.40-3.el8_0, java-1.8.0-ibm-headless 1.8.0.5.40-3.el8_0, +1 more
    fixed: vendor fix RHSA-2019:2590
  • Red Hat Enterprise Linux AppStream (v. 8) firefox 60.7.0-1.el8_0, thunderbird 60.7.0-1.el8_0
    fixed: vendor fix RHSA-2019:1269
  • Red Hat Enterprise Linux Client (v. 7) firefox 60.7.0-1.el7_6, thunderbird 60.7.0-1.el7_6 Red Hat Enterprise Linux Client Optional (v. 7) firefox 60.7.0-1.el7_6
    fixed: vendor fix RHSA-2019:1265
  • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.40-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.50-1jpp.1.el7, +4 more Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.40-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm-demo 1.8.0.5.40-1jpp.1.el7
    fixed: vendor fix RHSA-2019:2495
  • Red Hat Enterprise Linux Desktop (v. 6) firefox 60.7.0-1.el6_10, thunderbird 60.7.0-1.el6_10 Red Hat Enterprise Linux Desktop Optional (v. 6) firefox 60.7.0-1.el6_10
    fixed: vendor fix RHSA-2019:1267
  • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm-src 1.8.0.5.40-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.50-1jpp.1.el6_10, +4 more
    fixed: vendor fix RHSA-2019:2494
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) firefox 60.7.0-1.el7_6
    fixed: vendor fix RHSA-2019:1265
show 17 more
  • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) thunderbird 60.7.0-1.el7_6
    fixed: vendor fix RHSA-2019:1309
  • Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox 60.7.0-1.el6_10
    fixed: vendor fix RHSA-2019:1267
  • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm-src 1.8.0.5.40-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm-demo 1.8.0.5.40-1jpp.1.el6_10
    fixed: vendor fix RHSA-2019:2494
  • Red Hat Enterprise Linux Server (v. 6) firefox 60.7.0-1.el6_10
    fixed: vendor fix RHSA-2019:1267
  • Red Hat Enterprise Linux Server (v. 7) firefox 60.7.0-1.el7_6
    fixed: vendor fix RHSA-2019:1265
  • Red Hat Enterprise Linux Server Optional (v. 6) firefox 60.7.0-1.el6_10, thunderbird 60.7.0-1.el6_10
    fixed: vendor fix RHSA-2019:1267
  • Red Hat Enterprise Linux Server Optional (v. 7) firefox 60.7.0-1.el7_6, thunderbird 60.7.0-1.el7_6
    fixed: vendor fix RHSA-2019:1265
  • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm-src 1.8.0.5.40-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.50-1jpp.1.el6_10, +4 more
    fixed: vendor fix RHSA-2019:2494
  • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.40-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.50-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2019:2495
  • Red Hat Enterprise Linux Workstation (v. 6) firefox 60.7.0-1.el6_10, thunderbird 60.7.0-1.el6_10
    fixed: vendor fix RHSA-2019:1267
  • Red Hat Enterprise Linux Workstation (v. 7) firefox 60.7.0-1.el7_6, thunderbird 60.7.0-1.el7_6
    fixed: vendor fix RHSA-2019:1265
  • Red Hat Enterprise Linux Workstation Optional (v. 6) firefox 60.7.0-1.el6_10
    fixed: vendor fix RHSA-2019:1267
  • Red Hat Enterprise Linux Workstation Optional (v. 7) firefox 60.7.0-1.el7_6
    fixed: vendor fix RHSA-2019:1265
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.50-1jpp.1.el6_10, java-1.8.0-ibm-src 1.8.0.5.40-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.50-1jpp.1.el6_10, +4 more
    fixed: vendor fix RHSA-2019:2494
  • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.50-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.40-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.50-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2019:2495
  • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm 1.8.0.5.40-1jpp.1.el6_10
    fixed: vendor fix RHSA-2019:2737
  • Red Hat Enterprise Linux 5 libpng Red Hat Enterprise Linux 6 libpng Red Hat Enterprise Linux 7 libpng, libpng12 Red Hat Enterprise Linux 8 libpng12
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

9.39% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/glennrp/libpng/issues/275 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: adjust firefox, thunderbird, and java affected version ranges.