{"id":"USN-8639-1","summary":"libpng, libpng1.6 vulnerabilities","details":"Patrick Keshishian discovered that libpng incorrectly handled certain\ntext chunks. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10087)\n\nIt was discovered that libpng incorrectly handled certain malformed\nimages. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14048)\n\nIt was discovered that libpng incorrectly handled memory when freeing\ncertain images. An attacker could possibly use this issue to cause\na denial of service. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2019-7317)\n\nIt was discovered that libpng incorrectly handled memory when\nprocessing certain images. An attacker could possibly use this issue\nto cause a denial of service, or execute arbitrary code. This issue only\naffected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu\n20.04 LTS. (CVE-2026-33416)\n\nIt was discovered that libpng incorrectly handled certain images. An\nattacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. This issue only affected Ubuntu 20.04 LTS.\n(CVE-2026-33636)\n\nIt was discovered that libpng incorrectly handled memory when\nprocessing certain images. An attacker could possibly use this issue\nto cause a denial of service or obtain sensitive information. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and\nUbuntu 20.04 LTS. (CVE-2026-34757)\n\nSeung Min Shin discovered that libpng incorrectly handled certain\nanimated images. An attacker could possibly use this issue to cause\nlibpng to misinterpret image data. This issue only affected Ubuntu\n20.04 LTS and Ubuntu 22.04 LTS. (CVE-2026-40930)","modified":"2026-08-18T22:15:16.188001848Z","published":"2026-08-17T16:46:16Z","related":["UBUNTU-CVE-2016-10087","UBUNTU-CVE-2018-14048","UBUNTU-CVE-2019-7317","UBUNTU-CVE-2026-33416","UBUNTU-CVE-2026-33636","UBUNTU-CVE-2026-34757","UBUNTU-CVE-2026-40930"],"upstream":["UBUNTU-CVE-2016-10087","UBUNTU-CVE-2018-14048","UBUNTU-CVE-2019-7317","UBUNTU-CVE-2026-33416","UBUNTU-CVE-2026-33636","UBUNTU-CVE-2026-34757","UBUNTU-CVE-2026-40930"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8639-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2016-10087"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-14048"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-7317"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-33416"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-33636"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-34757"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-40930"}],"affected":[{"package":{"name":"libpng","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/libpng?arch=source&distro=esm-infra-legacy%2Ftrusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.50-1ubuntu2.14.04.3+esm2"}]}],"versions":["1.2.49-4ubuntu1","1.2.49-5ubuntu1","1.2.50-1ubuntu1","1.2.50-1ubuntu2","1.2.50-1ubuntu2.14.04.1","1.2.50-1ubuntu2.14.04.2","1.2.50-1ubuntu2.14.04.3","1.2.50-1ubuntu2.14.04.3+esm1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro","binaries":[{"binary_name":"libpng12-0","binary_version":"1.2.50-1ubuntu2.14.04.3+esm2"},{"binary_name":"libpng3","binary_version":"1.2.50-1ubuntu2.14.04.3+esm2"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:14.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-33416"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-34757"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"}},{"package":{"name":"libpng","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/libpng?arch=source&distro=esm-infra-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.54-1ubuntu1.1+esm3"}]}],"versions":["1.2.51-0ubuntu3","1.2.54-1","1.2.54-1ubuntu1","1.2.54-1ubuntu1.1","1.2.54-1ubuntu1.1+esm1","1.2.54-1ubuntu1.1+esm2"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro","binaries":[{"binary_version":"1.2.54-1ubuntu1.1+esm3","binary_name":"libpng12-0"},{"binary_name":"libpng3","binary_version":"1.2.54-1ubuntu1.1+esm3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:16.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-33416"},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-34757"}]}}},{"package":{"name":"libpng1.6","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/libpng1.6?arch=source&distro=esm-apps-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.20-2ubuntu0.1~esm4"}]}],"versions":["1.6.20-2","1.6.20-2ubuntu0.1~esm1","1.6.20-2ubuntu0.1~esm2","1.6.20-2ubuntu0.1~esm3"],"ecosystem_specific":{"binaries":[{"binary_name":"libpng16-16","binary_version":"1.6.20-2ubuntu0.1~esm4"},{"binary_name":"libpng16-devtools","binary_version":"1.6.20-2ubuntu0.1~esm4"},{"binary_version":"1.6.20-2ubuntu0.1~esm4","binary_name":"libpng16-tools"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2016-10087","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2019-7317","severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-33416","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-34757"}],"ecosystem":"Ubuntu:Pro:16.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"}},{"package":{"name":"libpng1.6","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/libpng1.6?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.34-1ubuntu0.18.04.2+esm3"}]}],"versions":["1.6.34-1","1.6.34-1ubuntu0.18.04.1","1.6.34-1ubuntu0.18.04.2","1.6.34-1ubuntu0.18.04.2+esm1","1.6.34-1ubuntu0.18.04.2+esm2"],"ecosystem_specific":{"binaries":[{"binary_name":"libpng-tools","binary_version":"1.6.34-1ubuntu0.18.04.2+esm3"},{"binary_name":"libpng16-16","binary_version":"1.6.34-1ubuntu0.18.04.2+esm3"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2018-14048","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"low","type":"Ubuntu"}]},{"id":"CVE-2026-33416","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-34757"}],"ecosystem":"Ubuntu:Pro:18.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"}},{"package":{"name":"libpng1.6","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/libpng1.6?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-2ubuntu0.1~esm3"}]}],"versions":["1.6.37-1","1.6.37-2","1.6.37-2ubuntu0.1~esm1","1.6.37-2ubuntu0.1~esm2"],"ecosystem_specific":{"binaries":[{"binary_name":"libpng-tools","binary_version":"1.6.37-2ubuntu0.1~esm3"},{"binary_version":"1.6.37-2ubuntu0.1~esm3","binary_name":"libpng16-16"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json","cves_map":{"ecosystem":"Ubuntu:Pro:20.04:LTS","cves":[{"id":"CVE-2026-33416","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-33636","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-34757","severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","type":"CVSS_V3"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-40930","severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]}]}}},{"package":{"name":"libpng1.6","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libpng1.6?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.37-3ubuntu0.6"}]}],"versions":["1.6.37-3build4","1.6.37-3build5","1.6.37-3ubuntu0.1","1.6.37-3ubuntu0.3","1.6.37-3ubuntu0.4","1.6.37-3ubuntu0.5"],"ecosystem_specific":{"binaries":[{"binary_name":"libpng-tools","binary_version":"1.6.37-3ubuntu0.6"},{"binary_version":"1.6.37-3ubuntu0.6","binary_name":"libpng16-16"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json","cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-40930"}]}}}],"schema_version":"1.9.0"}