CVE-2019-7317
firefox: png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-freebecause png_image_free_function is called u...
CVE-2019-7317 is fixed in 35 products on 1 platform, first by libpng-tools 1.6.34-1ubuntu0.18.04.2, released February 3, 2019. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.3
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0939
95th percentile
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-freebecause png_image_free_function is called under png_safe_execute.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| firefox · RHEL 8 | 0:60.7.0-1.el8_0 | RHSA-2019:1269 | May 23, 2019 |
| firefox · Ubuntu 18.04.6 LTS (bionic) | 67.0+build2-0ubuntu0.18.04.1 | firefox 67.0+build2-0ubuntu0.18.04.1 | May 20, 2019 |
| firefox · Ubuntu 24.10 (oracular) | 67.0+build2-0ubuntu1 | firefox 67.0+build2-0ubuntu1 | Feb 4, 2019 |
| firefox · Ubuntu 25.04 (plucky) | 67.0+build2-0ubuntu1 | firefox 67.0+build2-0ubuntu1 | Feb 4, 2019 |
| firefox · ol 8 | 0:60.7.0-1.0.2.el8_0 | ELSA-2019-1269 | Jul 30, 2019 |
| firefox-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 67.0+build2-0ubuntu0.18.04.1 | firefox-globalmenu 67.0+build2-0ubuntu0.18.04.1 | May 20, 2019 |
| firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 67.0+build2-0ubuntu0.18.04.1 | firefox-mozsymbols 67.0+build2-0ubuntu0.18.04.1 | May 20, 2019 |
| firefox-testsuite · Ubuntu 18.04.6 LTS (bionic) | 67.0+build2-0ubuntu0.18.04.1 | firefox-testsuite 67.0+build2-0ubuntu0.18.04.1 | May 20, 2019 |
| java-1.8.0-ibm · RHEL 8 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 | Sep 2, 2019 |
| java-1.8.0-ibm-demo · RHEL 8 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 | Sep 2, 2019 |
| java-1.8.0-ibm-devel · RHEL 8 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 | Sep 2, 2019 |
| java-1.8.0-ibm-headless · RHEL 8 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 | Sep 2, 2019 |
| java-1.8.0-ibm-jdbc · RHEL 8 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 | Sep 2, 2019 |
| java-1.8.0-ibm-plugin · RHEL 8 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 | Sep 2, 2019 |
| java-1.8.0-ibm-src · RHEL 8 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 | Sep 2, 2019 |
| java-1.8.0-ibm-webstart · RHEL 8 | 1:1.8.0.5.40-3.el8_0 | RHSA-2019:2590 | Sep 2, 2019 |
| libpng-tools · Ubuntu 18.04.6 LTS (bionic) | 1.6.34-1ubuntu0.18.04.2 | libpng-tools 1.6.34-1ubuntu0.18.04.2 | Feb 3, 2019 |
| libpng16-16 · Ubuntu 18.04.6 LTS (bionic) | 1.6.34-1ubuntu0.18.04.2 | libpng16-16 1.6.34-1ubuntu0.18.04.2 | Feb 3, 2019 |
| openjdk-11-demo · Ubuntu 18.04.6 LTS (bionic) | 11.0.4+11-1ubuntu2~18.04.3 | openjdk-11-demo 11.0.4+11-1ubuntu2~18.04.3 | Jul 22, 2019 |
| openjdk-11-jdk · Ubuntu 18.04.6 LTS (bionic) | 11.0.4+11-1ubuntu2~18.04.3 | openjdk-11-jdk 11.0.4+11-1ubuntu2~18.04.3 | Jul 22, 2019 |
| openjdk-11-jdk-headless · Ubuntu 18.04.6 LTS (bionic) | 11.0.4+11-1ubuntu2~18.04.3 | openjdk-11-jdk-headless 11.0.4+11-1ubuntu2~18.04.3 | Jul 22, 2019 |
| openjdk-11-jre · Ubuntu 18.04.6 LTS (bionic) | 11.0.4+11-1ubuntu2~18.04.3 | openjdk-11-jre 11.0.4+11-1ubuntu2~18.04.3 | Jul 22, 2019 |
| openjdk-11-jre-headless · Ubuntu 18.04.6 LTS (bionic) | 11.0.4+11-1ubuntu2~18.04.3 | openjdk-11-jre-headless 11.0.4+11-1ubuntu2~18.04.3 | Jul 22, 2019 |
| openjdk-11-jre-zero · Ubuntu 18.04.6 LTS (bionic) | 11.0.4+11-1ubuntu2~18.04.3 | openjdk-11-jre-zero 11.0.4+11-1ubuntu2~18.04.3 | Jul 22, 2019 |
| openjdk-11-source · Ubuntu 18.04.6 LTS (bionic) | 11.0.4+11-1ubuntu2~18.04.3 | openjdk-11-source 11.0.4+11-1ubuntu2~18.04.3 | Jul 22, 2019 |
| openjdk-8-demo · Ubuntu 18.04.6 LTS (bionic) | 8u222-b10-1ubuntu1~18.04.1 | openjdk-8-demo 8u222-b10-1ubuntu1~18.04.1 | Jul 22, 2019 |
| openjdk-8-jdk · Ubuntu 18.04.6 LTS (bionic) | 8u222-b10-1ubuntu1~18.04.1 | openjdk-8-jdk 8u222-b10-1ubuntu1~18.04.1 | Jul 22, 2019 |
| openjdk-8-jdk-headless · Ubuntu 18.04.6 LTS (bionic) | 8u222-b10-1ubuntu1~18.04.1 | openjdk-8-jdk-headless 8u222-b10-1ubuntu1~18.04.1 | Jul 22, 2019 |
| openjdk-8-jre · Ubuntu 18.04.6 LTS (bionic) | 8u222-b10-1ubuntu1~18.04.1 | openjdk-8-jre 8u222-b10-1ubuntu1~18.04.1 | Jul 22, 2019 |
| openjdk-8-jre-headless · Ubuntu 18.04.6 LTS (bionic) | 8u222-b10-1ubuntu1~18.04.1 | openjdk-8-jre-headless 8u222-b10-1ubuntu1~18.04.1 | Jul 22, 2019 |
| openjdk-8-jre-zero · Ubuntu 18.04.6 LTS (bionic) | 8u222-b10-1ubuntu1~18.04.1 | openjdk-8-jre-zero 8u222-b10-1ubuntu1~18.04.1 | Jul 22, 2019 |
| openjdk-8-source · Ubuntu 18.04.6 LTS (bionic) | 8u222-b10-1ubuntu1~18.04.1 | openjdk-8-source 8u222-b10-1ubuntu1~18.04.1 | Jul 22, 2019 |
| thunderbird · RHEL 8 | 0:60.7.0-1.el8_0 | RHSA-2019:1308 | Jun 3, 2019 |
| thunderbird · Ubuntu 18.04.6 LTS (bionic) | 1:60.7.0+build1-0ubuntu0.18.04.1 | thunderbird 1:60.7.0+build1-0ubuntu0.18.04.1 | May 20, 2019 |
| thunderbird · Ubuntu 24.10 (oracular) | 1:60.7.0+build1-0ubuntu3 | thunderbird 1:60.7.0+build1-0ubuntu3 | Feb 4, 2019 |
| thunderbird · Ubuntu 25.04 (plucky) | 1:60.7.0+build1-0ubuntu3 | thunderbird 1:60.7.0+build1-0ubuntu3 | Feb 4, 2019 |
| thunderbird · ol 8 | 0:60.7.0-1.0.1.el8_0 | ELSA-2019-1308 | Jul 30, 2019 |
| thunderbird-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 1:60.7.0+build1-0ubuntu0.18.04.1 | thunderbird-globalmenu 1:60.7.0+build1-0ubuntu0.18.04.1 | May 20, 2019 |
| thunderbird-gnome-support · Ubuntu 18.04.6 LTS (bionic) | 1:60.7.0+build1-0ubuntu0.18.04.1 | thunderbird-gnome-support 1:60.7.0+build1-0ubuntu0.18.04.1 | May 20, 2019 |
| thunderbird-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 1:60.7.0+build1-0ubuntu0.18.04.1 | thunderbird-mozsymbols 1:60.7.0+build1-0ubuntu0.18.04.1 | May 20, 2019 |
| xul-ext-calendar-timezones · Ubuntu 18.04.6 LTS (bionic) | 1:60.7.0+build1-0ubuntu0.18.04.1 | xul-ext-calendar-timezones 1:60.7.0+build1-0ubuntu0.18.04.1 | May 20, 2019 |
| xul-ext-gdata-provider · Ubuntu 18.04.6 LTS (bionic) | 1:60.7.0+build1-0ubuntu0.18.04.1 | xul-ext-gdata-provider 1:60.7.0+build1-0ubuntu0.18.04.1 | May 20, 2019 |
| xul-ext-lightning · Ubuntu 18.04.6 LTS (bionic) | 1:60.7.0+build1-0ubuntu0.18.04.1 | xul-ext-lightning 1:60.7.0+build1-0ubuntu0.18.04.1 | May 20, 2019 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.