Most recent entries from all

ALSA-2026:3031 — Important: libpng15 security update

Affected: AlmaLinux:9: libpng15

The libpng15 package provides libpng 1.5, an older version of the libpng. library for manipulating PNG (Portable Network Graphics) image format files. This version should be used only if you are unable to use the current version of libpng.

Security Fix(es):

* libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-01774

BELL-CVE-2026-25646

Affected: Alpaquita:23: libpng, Alpaquita:25: libpng, Alpaquita:stream: libpng, BellSoft Hardened Containers:23: libpng, BellSoft Hardened Containers:25: libpng, BellSoft Hardened Containers:stream: libpng

certfr-2026-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0199

Withdrawn: CLEANSTART-2026-AO11810 — Netty is an asynchronous, event-driven network application framework

Withdrawn by the publisher.

Affected: CleanStart: apache-zookeeper

Multiple security vulnerabilities affect the apache-zookeeper package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details.

EUVD-2026-362285

fkie_cve-2026-25646

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.

OESA-2026-1476 — libpng security update

Affected: openEuler:24.03-LTS-SP3: libpng, openEuler:20.03-LTS-SP4: libpng, openEuler:22.03-LTS-SP4: libpng, openEuler:24.03-LTS: libpng, openEuler:24.03-LTS-SP1: libpng, openEuler:24.03-LTS-SP2: libpng

The libpng package contains libraries used by other programs for reading and writing PNG format files. The PNG format was designed as a replacement for GIF and, to a lesser extent, TIFF, with many improvements and extensions and lack of patent problems. Security Fix(es):

openSUSE-SU-2026:10188-1 — libpng16-16-1.6.55-1.1 on GA media

libpng16-16-1.6.55-1.1 on GA media

RHSA-2026:10097 — Red Hat Security Advisory: OpenShift Container Platform 4.16.60 bug fix and security update

grub2: Missing unregister call for gettext command may lead to use-after-free libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing libpng: LIBPNG has a heap buffer overflow in png_set_quantize vim: Vim: Arbitrary code execution via 'helpfile' option processing vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file vim: Vim: Arbitrary code execution via command injection in glob() function

SUSE-SU-2026:0583-1 — Security update for libpng16

Security update for libpng16

UBUNTU-CVE-2026-25646

Affected: Ubuntu:Pro:14.04:LTS: libpng, Ubuntu:Pro:16.04:LTS: libpng, Ubuntu:Pro:16.04:LTS: libpng1.6, Ubuntu:Pro:18.04:LTS: libpng1.6, Ubuntu:Pro:20.04:LTS: libpng1.6, Ubuntu:22.04:LTS: libpng1.6, Ubuntu:24.04:LTS: libpng1.6, Ubuntu:25.10: libpng1.6, Ubuntu:26.04:LTS: libpng1.6

WID-SEC-W-2026-0353 — libpng: Schwachstelle ermöglicht Codeausführung

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in libpng ausnutzen, um möglicherweise beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.