The pngsettext_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "binary_version": "1.2.50-1ubuntu2.14.04.3", "binary_name": "libpng12-0" }, { "binary_version": "1.2.50-1ubuntu2.14.04.3", "binary_name": "libpng12-0-dbgsym" }, { "binary_version": "1.2.50-1ubuntu2.14.04.3", "binary_name": "libpng12-0-udeb" }, { "binary_version": "1.2.50-1ubuntu2.14.04.3", "binary_name": "libpng12-0-udeb-dbgsym" }, { "binary_version": "1.2.50-1ubuntu2.14.04.3", "binary_name": "libpng12-dev" }, { "binary_version": "1.2.50-1ubuntu2.14.04.3", "binary_name": "libpng3" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "binary_version": "1.2.54-1ubuntu1.1", "binary_name": "libpng12-0" }, { "binary_version": "1.2.54-1ubuntu1.1", "binary_name": "libpng12-0-dbgsym" }, { "binary_version": "1.2.54-1ubuntu1.1", "binary_name": "libpng12-0-udeb" }, { "binary_version": "1.2.54-1ubuntu1.1", "binary_name": "libpng12-0-udeb-dbgsym" }, { "binary_version": "1.2.54-1ubuntu1.1", "binary_name": "libpng12-dev" }, { "binary_version": "1.2.54-1ubuntu1.1", "binary_name": "libpng3" } ] }