{"id":"CLSA-2026-1785937319","summary":"Fix CVE(s): CVE-2026-33416, CVE-2026-33636","details":"   * SECURITY UPDATE: out-of-bounds read/write in ARM NEON palette expansion\n     - debian/patches/CVE-2026-33636.patch: restrict the NEON loop in\n       png_do_expand_palette_rgba8_neon and png_do_expand_palette_rgb8_neon\n       (arm/palette_neon_intrinsics.c) to full chunks only, so rows whose\n       width is not a multiple of the chunk size no longer read or write\n       past the row buffer\n     - CVE-2026-33636","modified":"2026-10-26T09:31:15.747288109Z","published":"2026-08-05T13:42:11Z","upstream":["CVE-2026-33416","CVE-2026-33636"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1785937319.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33416"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33636"}],"affected":[{"package":{"name":"libpng-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpng-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1785937319.json"}},{"package":{"name":"libpng-tools","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpng-tools?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1785937319.json"}},{"package":{"name":"libpng16-16","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpng16-16?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1785937319.json"}}],"schema_version":"1.9.0"}