CVE-2019-7317 Use after free in n/a
A use-after-free vulnerability in libpng allows attackers to execute arbitrary code or cause a denial of service via crafted PNG images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-7317?
CVE-2019-7317 is a medium-severity use after free vulnerability in Canonical Ubuntu Linux, published on 4 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Weakness: CWE-416
Which versions are affected by CVE-2019-7317?
It affects 32 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Hp Xp7 Command View, Hpe Xp7 Command View Advanced Edition Suite, Libpng Libpng, Mozilla Firefox and 26 more.
How do I fix CVE-2019-7317?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2019-7317 being exploited?
There is no known exploitation of CVE-2019-7317 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2019-7317, AZL-45210, AZL-45288, CLEANSTART-2026-CP81765, CLEANSTART-2026-HQ42098, DEBIAN-CVE-2019-7317 and 8 more.