ALT-PU-2025-15349-2

Package update libpng16 in branch sisyphus

Version1.6.52-alt1

Published2026-02-04

Max severityHIGH

Severity:

Closed issues (2)

HIGH7.1

Уязвимость функции png_image_read_composite() библиотеки libpng, позволяющая нарушителю оказать воздействие на конфиденциальность и доступность защищаемой информации

Published: 2025-12-08Modified: 2026-04-20

CVSS 3.xHIGH 7.1

CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

CVSS 2.0HIGH 8.5

CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:C

References

CVE-2025-66293

HIGH7.1

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.

Published: 2025-12-03Modified: 2025-12-16

CVSS 3.xHIGH 7.1

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

References