What’s Vulnerable › Vulnerabilities

CVE-2019-7317

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-04 · updated 2026-06-17
• Weakness: CWE-416

Description

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Affected products

• Canonical Ubuntu Linux: 16.04, 18.04, 18.10, 19.04
• Debian Linux: 8.0, 9.0
• HP Xp7 Command View: before 8.7.0-00 — fixed in 8.7.0-00
• HPE Xp7 Command View Advanced Edition Suite: before 8.7.0-00 — fixed in 8.7.0-00
• pnggroup libpng: from 1.6.0 before 1.6.37 — fixed in 1.6.37
• Mozilla Firefox: all versions
• Mozilla Thunderbird: all versions
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: before 9.6; 9.6 — fixed in 9.6
• NetApp Cloud Backup: all versions
• NetApp E-Series Santricity Management: all versions
• NetApp E-Series Santricity Storage Manager: before 11.53 — fixed in 11.53
• NetApp E-Series Santricity Unified Manager: before 3.2 — fixed in 3.2
• NetApp E-Series Santricity Web Services: before 4.0 — fixed in 4.0
• OnCommand Insight: before 7.3.9 — fixed in 7.3.9
• NetApp OnCommand Workflow Automation: before 5.1 — fixed in 5.1
• NetApp Plug-In For Symantec Netbackup: all versions
• SnapManager for Oracle: before 3.4.2; 3.4.2-p1 — fixed in 3.4.2
• NetApp Steelstore: all versions
• openSUSE Leap: 15.0, 15.1, 42.3
• openSUSE Package Hub: all versions
• Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.2.6.0
• Oracle Java SE: 7u221, 8u212
• Oracle Java SE: 11.0.3, 12.0.1
• MySQL Server: before 8.0.23 — fixed in 8.0.23
• Red Hat Enterprise Linux: 6.0, 7.0, 8.0
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux For Ibm Z Systems: 6.0, 7.0, 8.0
• RedHat Enterprise Linux For Power Big Endian: 6.0, 7.0
• RedHat Enterprise Linux For Power Little Endian: 7.0, 8.0
• RedHat Enterprise Linux For Scientific Computing: 6.0, 7.0

How to fix

Upgrade to a fixed version: HP Xp7 Command View 8.7.0-00; HPE Xp7 Command View Advanced Edition Suite 8.7.0-00; pnggroup libpng 1.6.37; Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows 9.6; NetApp E-Series Santricity Storage Manager 11.53; NetApp E-Series Santricity Unified Manager 3.2; NetApp E-Series Santricity Web Services 4.0; OnCommand Insight 7.3.9; NetApp OnCommand Workflow Automation 5.1; SnapManager for Oracle 3.4.2; MySQL Server 8.0.23. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html
• http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html
• http://www.securityfocus.com/bid/108098
• https://access.redhat.com/errata/RHSA-2019:1265
• https://access.redhat.com/errata/RHSA-2019:1267
• https://access.redhat.com/errata/RHSA-2019:1269
• https://access.redhat.com/errata/RHSA-2019:1308
• https://access.redhat.com/errata/RHSA-2019:1309

Get alerted when CVE-2019-7317 or the next vulnerability affects your stack