CVE-2019-7317

CVSS v3.1 5.3 (Medium)

CVSS v2.0 2.6 (Low)

EPSS 0.46 % (76^th)

Affected Products 33

Advisories 58

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Weaknesses

CWE-416: Use After Free

CVE Status: PUBLISHED
CNA: MITRE
Published Date: 2019-02-04 08:29:00
(5 years ago)
Updated Date: 2022-05-23 15:02:40
(2 years ago)

Affected Products

Mozilla

Netapp

Opensuse

Oracle

Redhat

Suse

Linux Enterprise

Configuration #1

AND

		CPE23	From	Up To
OR
	Libpng from 1.6.0 version and prior 1.6.37 version	cpe:2.3:a:libpng:libpng	>= 1.6.0	< 1.6.37

Configuration #2

AND

		CPE23
OR
	Debian Linux 8.0	cpe:2.3:o:debian:debian_linux:8.0
OR
	Running on/with
	Debian Linux 9.0	cpe:2.3:o:debian:debian_linux:9.0

Configuration #3

AND

		CPE23
OR
	Canonical Ubuntu Linux 16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04
OR
	Running on/with
	Canonical Ubuntu Linux 16.04	cpe:2.3:o:canonical:ubuntu_linux:16.04:::*:esm
OR
	Running on/with
	Canonical Ubuntu Linux 18.04	cpe:2.3:o:canonical:ubuntu_linux:18.04:::*:lts
OR
	Running on/with
	Canonical Ubuntu Linux 18.10	cpe:2.3:o:canonical:ubuntu_linux:18.10
OR
	Running on/with
	Canonical Ubuntu Linux 19.04	cpe:2.3:o:canonical:ubuntu_linux:19.04

Configuration #4

AND

		CPE23	Up To
OR
	Oracle Hyperion Infrastructure Technology 11.2.6.0	cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.6.0
OR
	Running on/with
	Oracle Java Se 7u221	cpe:2.3:a:oracle:java_se:7u221
OR
	Running on/with
	Oracle Java Se 8u212	cpe:2.3:a:oracle:java_se:8u212
OR
	Running on/with
	Oracle Jdk 11.0.3	cpe:2.3:a:oracle:jdk:11.0.3
OR
	Running on/with
	Oracle Jdk 12.0.1	cpe:2.3:a:oracle:jdk:12.0.1
OR
	Running on/with
	Oracle Mysql prior 8.0.23 version	cpe:2.3:a:oracle:mysql	< 8.0.23

Configuration #5

AND

		CPE23	Up To
OR
	Hp Xp7 Command View prior 8.7.0-00 version	cpe:2.3:a:hp:xp7_command_view::::*:advanced	< 8.7.0-00
OR
	Running on/with
	Hpe Xp7 Command View Advanced Edition Suite prior 8.7.0-00 version	cpe:2.3:a:hpe:xp7_command_view_advanced_edition_suite	< 8.7.0-00

Configuration #6

AND

		CPE23
OR
	Mozilla Firefox Esr	cpe:2.3:a:mozilla:firefox_esr:-
OR
	Running on/with
	Mozilla Thunderbird	cpe:2.3:a:mozilla:thunderbird:-

Configuration #7

AND

		CPE23
OR
	Opensuse Leap 15.0	cpe:2.3:o:opensuse:leap:15.0
OR
	Running on/with
	Opensuse Leap 15.1	cpe:2.3:o:opensuse:leap:15.1
OR
	Running on/with
	Opensuse Leap 42.3	cpe:2.3:o:opensuse:leap:42.3

Configuration #8

AND

		CPE23
OR
	Opensuse Package Hub	cpe:2.3:a:opensuse:package_hub:-
OR
	Running on/with
	Suse Linux Enterprise 12.0	cpe:2.3:o:suse:linux_enterprise:12.0

Configuration #9

AND

		CPE23	Up To
OR
	Netapp Active Iq Unified Manager for Vmware Vsphere prior 9.6 version	cpe:2.3:a:netapp:active_iq_unified_manager::::::vmware_vsphere	< 9.6
OR
	Running on/with
	Netapp Active Iq Unified Manager for Windows prior 9.6 version	cpe:2.3:a:netapp:active_iq_unified_manager::::::windows	< 9.6
OR
	Running on/with
	Netapp Active Iq Unified Manager 9.6 for Vmware Vsphere	cpe:2.3:a:netapp:active_iq_unified_manager:9.6:::::vmware_vsphere
OR
	Running on/with
	Netapp Active Iq Unified Manager 9.6 for Windows	cpe:2.3:a:netapp:active_iq_unified_manager:9.6:::::windows
OR
	Running on/with
	Netapp Cloud Backup	cpe:2.3:a:netapp:cloud_backup:-
OR
	Running on/with
	Netapp E-series Santricity Management for Vcenter	cpe:2.3:a:netapp:e-series_santricity_management:-:::::vcenter
OR
	Running on/with
	Netapp E-series Santricity Storage Manager prior 11.53 version	cpe:2.3:a:netapp:e-series_santricity_storage_manager	< 11.53
OR
	Running on/with
	Netapp E-series Santricity Unified Manager prior 3.2 version	cpe:2.3:a:netapp:e-series_santricity_unified_manager	< 3.2
OR
	Running on/with
	Netapp E-series Santricity Web Services for Web Services Proxy prior 4.0 version	cpe:2.3:a:netapp:e-series_santricity_web_services::::::web_services_proxy	< 4.0
OR
	Running on/with
	Netapp Oncommand Insight prior 7.3.9 version	cpe:2.3:a:netapp:oncommand_insight	< 7.3.9
OR
	Running on/with
	Netapp Oncommand Workflow Automation prior 5.1 version	cpe:2.3:a:netapp:oncommand_workflow_automation	< 5.1
OR
	Running on/with
	Netapp Plug-in for Symantec Netbackup	cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-
OR
	Running on/with
	Netapp Snapmanager for Oracle prior 3.4.2 version	cpe:2.3:a:netapp:snapmanager::::::oracle	< 3.4.2
OR
	Running on/with
	Netapp Snapmanager for Sap prior 3.4.2 version	cpe:2.3:a:netapp:snapmanager::::::sap	< 3.4.2
OR
	Running on/with
	Netapp Snapmanager 3.4.2 P1 for Oracle	cpe:2.3:a:netapp:snapmanager:3.4.2:p1:::*:oracle
OR
	Running on/with
	Netapp Snapmanager 3.4.2 P1 for Sap	cpe:2.3:a:netapp:snapmanager:3.4.2:p1:::*:sap
OR
	Running on/with
	Netapp Steelstore	cpe:2.3:a:netapp:steelstore:-

Configuration #10

AND

		CPE23
OR
	Redhat Satellite 5.8	cpe:2.3:a:redhat:satellite:5.8
OR
	Running on/with
	Redhat Enterprise Linux 6.0	cpe:2.3:o:redhat:enterprise_linux:6.0
OR
	Running on/with
	Redhat Enterprise Linux 7.0	cpe:2.3:o:redhat:enterprise_linux:7.0
OR
	Running on/with
	Redhat Enterprise Linux 8.0	cpe:2.3:o:redhat:enterprise_linux:8.0
OR
	Running on/with
	Redhat Enterprise Linux Desktop 6.0	cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
OR
	Running on/with
	Redhat Enterprise Linux Desktop 7.0	cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
OR
	Running on/with
	Redhat Enterprise Linux for Ibm Z Systems 6.0	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0
OR
	Running on/with
	Redhat Enterprise Linux for Ibm Z Systems 7.0	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0
OR
	Running on/with
	Redhat Enterprise Linux for Ibm Z Systems 8.0	cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0
OR
	Running on/with
	Redhat Enterprise Linux for Power Big Endian 6.0	cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0
OR
	Running on/with
	Redhat Enterprise Linux for Power Big Endian 7.0	cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0
OR
	Running on/with
	Redhat Enterprise Linux for Power Little Endian 7.0	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0
OR
	Running on/with
	Redhat Enterprise Linux for Power Little Endian 8.0	cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0
OR
	Running on/with
	Redhat Enterprise Linux for Scientific Computing 6.0	cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0
OR
	Running on/with
	Redhat Enterprise Linux for Scientific Computing 7.0	cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0
OR
	Running on/with
	Redhat Enterprise Linux Workstation 6.0	cpe:2.3:o:redhat:enterprise_linux_workstation:6.0
OR
	Running on/with
	Redhat Enterprise Linux Workstation 7.0	cpe:2.3:o:redhat:enterprise_linux_workstation:7.0