{"id":"CLSA-2026-1788344031","summary":"Fix CVE(s): CVE-2026-40930","details":"   * SECURITY UPDATE: chunk data smuggling in the APNG push-mode reader\n     - debian/patches/CVE-2026-40930.patch: consume the chunk body and the\n       CRC field in the three inter-frame discard paths of\n       png_push_read_chunk (pngpread.c), so that bytes inside an ignored\n       chunk are no longer reinterpreted as a fresh chunk header on the\n       next png_process_data call, and pass the real chunk length to\n       png_ensure_sequence_number in png_push_read_IDAT (pngpread.c), so\n       that an fdAT chunk shorter than its own sequence number no longer\n       underflows idat_size and swallows the rest of the stream as frame\n       data\n     - CVE-2026-40930","modified":"2026-10-26T09:30:09.192082477Z","published":"2026-09-02T10:14:03Z","upstream":["CVE-2026-40930"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1788344031.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40930"}],"affected":[{"package":{"name":"libpng-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpng-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1788344031.json"}},{"package":{"name":"libpng-tools","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpng-tools?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1788344031.json"}},{"package":{"name":"libpng16-16","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libpng16-16?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1788344031.json"}}],"schema_version":"1.9.0"}