libpng before 1.6.32 does not properly check the length of chunks against the user limit.

🗓️ 14 Mar 2025 07:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 5 Views

Libpng versions before 1.6.32 fail to validate chunk lengths against user limits.

Reporter	Title	Published	Views	Family All 109
IBM Security Bulletins	Security Bulletin: Gdal vulnerabilities affect IBM Netezza Analytics for NPS	3 Jun 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability has been identified in BigFix Platform shipped with IBM License Metric Tool.	12 Aug 202008:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities.	19 Jul 202221:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2020-1971, CVE-2020-15999, CVE-2017-12652)	16 Aug 202107:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilties have been fixed in the IBM Security Access Manager and IBM Security Verify Access appliances.	16 Mar 202119:55	–	ibm
Tenable Nessus	Amazon Linux 2 : libpng (ALAS-2020-1528)	27 Oct 202000:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: fltk (CVE-2017-12652)	22 Jan 202600:00	–	nessus
Tenable Nessus	CentOS 7 : libpng (RHSA-2020:3901)	20 Oct 202000:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : libpng (EulerOS-SA-2019-1855)	17 Sep 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : libpng (EulerOS-SA-2019-1912)	16 Sep 201900:00	–	nessus

Vulners

Node

OR

microsoft azl3_fltk_1.3.8-1Range<1.3.8-1

microsoft azl3_fltk_1.3.8-1Range<1.3.8-1

14 Mar 2025 07:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 27.5

CVSS 3.19.8

EPSS0.04113

SSVC

libpng vulnerability chunk length validation user limit older versions