What’s Vulnerable › Vulnerabilities

CVE-2018-13785

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-09 · updated 2026-06-17
• Weakness: CWE-190

Description

In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 17.10, 18.04
• pnggroup libpng: 1.6.34
• Oracle Java SE: 1.6.0-update201, 1.7.0-update191, 1.8.0-update181, 11.0.0
• Oracle Java SE: 1.6.0-update201, 1.7.0-update191, 1.8.0-update181, 11.0.0
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Workstation: 6.0, 7.0

References

• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• http://www.securityfocus.com/bid/105599
• http://www.securitytracker.com/id/1041889
• https://access.redhat.com/errata/RHSA-2018:3000
• https://access.redhat.com/errata/RHSA-2018:3001
• https://access.redhat.com/errata/RHSA-2018:3002
• https://access.redhat.com/errata/RHSA-2018:3003
• https://access.redhat.com/errata/RHSA-2018:3007
• https://access.redhat.com/errata/RHSA-2018:3008
• https://access.redhat.com/errata/RHSA-2018:3533
• https://access.redhat.com/errata/RHSA-2018:3534
• https://access.redhat.com/errata/RHSA-2018:3671

Get alerted when CVE-2018-13785 or the next vulnerability affects your stack