Skip to content
Fencer Vulns
medium 6.5

CVE-2018-13785 json

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and…

published 2018-07-09 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-5723

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.4%
EPSS 4.4% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.

Patch / fix

  • libpng1.6 Debian 14, Debian 13, Debian 12 1.6.34-2

debian advisories DEBIAN-CVE-2018-13785

  • libpng1.6 Ubuntu 18.04 LTS 1.6.34-1ubuntu0.18.04.1

ubuntu advisories UBUNTU-CVE-2018-13785

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • java-1.7.1-ibm RHEL 6 EXTRAS, network satellite 5.7, network satellite 5.6 1:1.7.1.4.35-1jpp.1.el6_10
  • java-1.8.0-ibm RHEL 6 EXTRAS, network satellite 5.8 1:1.8.0.5.25-1jpp.1.el6_10
  • java-1.7.1-ibm RHEL 7 EXTRAS 1:1.7.1.4.35-1jpp.1.el7
  • java-1.7.1-ibm-src RHEL 7 EXTRAS 1:1.7.1.4.35-1jpp.1.el7
  • java-1.7.1-ibm-demo RHEL 7 EXTRAS 1:1.7.1.4.35-1jpp.1.el7
  • java-1.7.1-ibm-jdbc RHEL 7 EXTRAS 1:1.7.1.4.35-1jpp.1.el7
  • java-1.7.1-ibm-plugin RHEL 7 EXTRAS 1:1.7.1.4.35-1jpp.1.el7
  • java-1.8.0-ibm-src RHEL 6 EXTRAS 1:1.8.0.5.25-1jpp.1.el6_10

red hat advisories RHSA-2018:3779RHSA-2018:3852RHSA-2018:3672RHSA-2018:3533RHSA-2018:3671RHSA-2018:3008

  • libpng16 SLE Module for Basesystem 15 SP1, SLE Module for Basesystem 15 1.6.34-3.9.1
  • java-1_8_0-openjdk SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +10 more 1.8.0.191-27.29.1
  • java-1_8_0-ibm SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +10 more 1.8.0_sr5.25-30.39.1
  • java-1_7_1-ibm SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +11 more 1.7.1_sr4.35-38.29.1
  • java-1_7_0-openjdk SLES 12 SP4, SLES 12 SP3, SLES 12 SP2-BCL +11 more 1.7.0.201-43.18.1
  • java-1_8_0-openjdk SLE Module for Package Hub 15, SLE Module for Legacy 15 1.8.0.191-3.13.1
  • java-1_7_1-ibm SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 1.7.1_sr4.35-26.32.1
  • java-1_7_0-ibm SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 1.7.0_sr10.35-65.31.1

suse advisories SUSE-SU-2019:1398-2SUSE-SU-2019:1398-1SUSE-SU-2019:0057-2SUSE-SU-2018:4064-2SUSE-SU-2018:3933-2SUSE-SU-2019:0049-2

  • java-1_8_0-openjdk openSUSE Tumbleweed 1.8.0.302-2.2
  • libpng16 openSUSE Tumbleweed 1.6.37-3.3
  • libpng16 openSUSE Leap 15.1, openSUSE Leap 15.0 1.6.34-lp151.3.3.1
  • java-1_8_0-openjdk openSUSE Leap 15.0 1.8.0.191-lp150.2.9.2

opensuse advisories openSUSE-SU-2024:10876-1openSUSE-SU-2024:10972-1openSUSE-SU-2019:1530-1openSUSE-SU-2019:0043-1

  • openjdk7 Alpine 3.18, Alpine 3.17, Alpine 3.16 +10 more 7.201.2.6.16-r0
  • openjdk8 Alpine 3.24, Alpine 3.23, Alpine 3.22 +17 more 8.191.12-r0

alpine advisories ALPINE-CVE-2018-13785

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-13785 updated cvss 6.5

libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service

  • Red Hat Enterprise Linux 6 java-1.6.0-ibm, java-1.6.0-ibm-src, java-1.6.0-ibm-demo, java-1.6.0-ibm-jdbc, java-1.6.0-ibm-plugin, java-1.6.0-ibm-javacomm
    affected: no fix planned “Will not fix”
  • Red Hat Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.6.0-sun 1.6.0.211-1jpp.1.el7, java-1.7.0-oracle 1.7.0.201-1jpp.1.el7, java-1.8.0-oracle 1.8.0.191-1jpp.1.el7, java-1.6.0-sun-src 1.6.0.211-1jpp.1.el7, java-1.6.0-sun-demo 1.6.0.211-1jpp.1.el7, java-1.6.0-sun-jdbc 1.6.0.211-1jpp.1.el7, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.6.0-sun 1.6.0.211-1jpp.1.el7, java-1.7.0-oracle 1.7.0.201-1jpp.1.el7, java-1.8.0-oracle 1.8.0.191-1jpp.1.el7, java-1.6.0-sun-src 1.6.0.211-1jpp.1.el7, java-1.6.0-sun-demo 1.6.0.211-1jpp.1.el7, java-1.6.0-sun-jdbc 1.6.0.211-1jpp.1.el7, +5 more
    fixed: vendor fix RHSA-2018:3007
  • Red Hat Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.6.0-sun 1.6.0.211-1jpp.1.el6, java-1.7.0-oracle 1.7.0.201-1jpp.1.el6, java-1.8.0-oracle 1.8.0.191-1jpp.1.el6, java-1.6.0-sun-src 1.6.0.211-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.211-1jpp.1.el6, java-1.6.0-sun-jdbc 1.6.0.211-1jpp.1.el6, +9 more Red Hat Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.6.0-sun 1.6.0.211-1jpp.1.el6, java-1.7.0-oracle 1.7.0.201-1jpp.1.el6, java-1.8.0-oracle 1.8.0.191-1jpp.1.el6, java-1.6.0-sun-src 1.6.0.211-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.211-1jpp.1.el6, java-1.6.0-sun-jdbc 1.6.0.211-1jpp.1.el6, +9 more
    fixed: vendor fix RHSA-2018:3008
  • Red Hat Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.6.0-sun 1.6.0.211-1jpp.1.el7, java-1.7.0-oracle 1.7.0.201-1jpp.1.el7, java-1.8.0-oracle 1.8.0.191-1jpp.1.el7, java-1.6.0-sun-src 1.6.0.211-1jpp.1.el7, java-1.6.0-sun-demo 1.6.0.211-1jpp.1.el7, java-1.6.0-sun-jdbc 1.6.0.211-1jpp.1.el7, +9 more
    fixed: vendor fix RHSA-2018:3007
  • Red Hat Oracle Java for Red Hat Enterprise Linux Server 6 java-1.6.0-sun 1.6.0.211-1jpp.1.el6, java-1.7.0-oracle 1.7.0.201-1jpp.1.el6, java-1.8.0-oracle 1.8.0.191-1jpp.1.el6, java-1.6.0-sun-src 1.6.0.211-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.211-1jpp.1.el6, java-1.6.0-sun-jdbc 1.6.0.211-1jpp.1.el6, +9 more
    fixed: vendor fix RHSA-2018:3008
  • Red Hat Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.6.0-sun 1.6.0.211-1jpp.1.el7, java-1.7.0-oracle 1.7.0.201-1jpp.1.el7, java-1.8.0-oracle 1.8.0.191-1jpp.1.el7, java-1.6.0-sun-src 1.6.0.211-1jpp.1.el7, java-1.6.0-sun-demo 1.6.0.211-1jpp.1.el7, java-1.6.0-sun-jdbc 1.6.0.211-1jpp.1.el7, +9 more
    fixed: vendor fix RHSA-2018:3007
  • Red Hat Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.6.0-sun 1.6.0.211-1jpp.1.el6, java-1.7.0-oracle 1.7.0.201-1jpp.1.el6, java-1.8.0-oracle 1.8.0.191-1jpp.1.el6, java-1.6.0-sun-src 1.6.0.211-1jpp.1.el6, java-1.6.0-sun-demo 1.6.0.211-1jpp.1.el6, java-1.6.0-sun-jdbc 1.6.0.211-1jpp.1.el6, +9 more
    fixed: vendor fix RHSA-2018:3008
  • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.25-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.35-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.35-1jpp.1.el7, +4 more Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.25-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm-demo 1.8.0.5.25-1jpp.1.el7
    fixed: vendor fix RHSA-2018:3672
show 7 more
  • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm-src 1.8.0.5.25-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.35-1jpp.1.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.35-1jpp.1.el6_10, +4 more Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm-src 1.8.0.5.25-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm-demo 1.8.0.5.25-1jpp.1.el6_10 Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm-src 1.8.0.5.25-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.35-1jpp.1.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.35-1jpp.1.el6_10, +4 more
    fixed: vendor fix RHSA-2018:3671
  • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.25-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.35-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.35-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2018:3672
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el6_10, java-1.7.1-ibm-src 1.7.1.4.35-1jpp.1.el6_10, java-1.8.0-ibm-src 1.8.0.5.25-1jpp.1.el6_10, java-1.7.1-ibm-demo 1.7.1.4.35-1jpp.1.el6_10, java-1.7.1-ibm-jdbc 1.7.1.4.35-1jpp.1.el6_10, +4 more
    fixed: vendor fix RHSA-2018:3671
  • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el7, java-1.7.1-ibm-src 1.7.1.4.35-1jpp.1.el7, java-1.8.0-ibm-src 1.8.0.5.25-1jpp.1.el7, java-1.7.1-ibm-demo 1.7.1.4.35-1jpp.1.el7, java-1.7.1-ibm-jdbc 1.7.1.4.35-1jpp.1.el7, +4 more
    fixed: vendor fix RHSA-2018:3672
  • Red Hat Satellite 5.6 (RHEL v.6) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el6_10 Red Hat Satellite 5.7 (RHEL v.6) java-1.7.1-ibm 1.7.1.4.35-1jpp.1.el6_10
    fixed: vendor fix RHSA-2018:3779
  • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm 1.8.0.5.25-1jpp.1.el6_10
    fixed: vendor fix RHSA-2018:3852
  • Red Hat Enterprise Linux 5 libpng Red Hat Enterprise Linux 6 libpng Red Hat Enterprise Linux 7 libpng, libpng12 Red Hat Enterprise Linux 8 libpng, libpng12 Red Hat Virtualization 4 libpng
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

4.38% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.