CLSA-2026-1777552532
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1777552532
- Upstream
- Published
- 2026-04-30T12:35:45Z
- Modified
- 2026-06-04T09:47:37.822789783Z
- Summary
- Fix CVE(s): CVE-2025-64720, CVE-2025-65018
- Details
-
- No-source-change rebuild against libpng (>= 1.6.37-2+tuxcare.els2) to
pick up the libpng security fixes for:
- CVE-2025-64720: pngimagereadcomposite OOB read on palette images with PNGFLAGOPTIMIZEALPHA (libpng < 1.6.51).
- CVE-2025-65018: pngimagefinish_read heap buffer overflow on 16-bit interlaced PNGs with 8-bit output (libpng < 1.6.51). Both vulnerabilities live entirely in libpng (used in OpenJDK only via the system libpng linked into libsplashscreen / AWT image decoding via libsplashscreen --with-libpng=system); no OpenJDK source change is required. The fix is delivered by the libpng rebuild (build 69ef31c7922f4d8bf30fd637, libpng1.6 1.6.37-2+tuxcare.els2). Bumping the Build-Depends floor on libpng-dev guarantees the fixed headers/library are linked in this rebuild.
- No-source-change rebuild against libpng (>= 1.6.37-2+tuxcare.els2) to
pick up the libpng security fixes for:
- References