USN-8639-1

Patrick Keshishian discovered that libpng incorrectly handled certain text chunks. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10087)

It was discovered that libpng incorrectly handled certain malformed images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14048)

It was discovered that libpng incorrectly handled memory when freeing certain images. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2019-7317)

It was discovered that libpng incorrectly handled memory when processing certain images. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-33416)

It was discovered that libpng incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-33636)

It was discovered that libpng incorrectly handled memory when processing certain images. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-34757)

Seung Min Shin discovered that libpng incorrectly handled certain animated images. An attacker could possibly use this issue to cause libpng to misinterpret image data. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2026-40930)

References

Affected packages

Ubuntu:22.04:LTS

libpng1.6

Package

Name: libpng1.6
Purl: pkg:deb/ubuntu/libpng1.6?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.37-3ubuntu0.6

Affected versions

1.*

1.6.37-3build4

1.6.37-3build5

1.6.37-3ubuntu0.1

1.6.37-3ubuntu0.3

1.6.37-3ubuntu0.4

1.6.37-3ubuntu0.5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libpng-tools",
            "binary_version": "1.6.37-3ubuntu0.6"
        },
        {
            "binary_name": "libpng16-16",
            "binary_version": "1.6.37-3ubuntu0.6"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-40930"
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}

Ubuntu:Pro:14.04:LTS

libpng

Package

Name: libpng
Purl: pkg:deb/ubuntu/libpng?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.50-1ubuntu2.14.04.3+esm2

Affected versions

1.*

1.2.49-4ubuntu1

1.2.49-5ubuntu1

1.2.50-1ubuntu1

1.2.50-1ubuntu2

1.2.50-1ubuntu2.14.04.1

1.2.50-1ubuntu2.14.04.2

1.2.50-1ubuntu2.14.04.3

1.2.50-1ubuntu2.14.04.3+esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libpng12-0",
            "binary_version": "1.2.50-1ubuntu2.14.04.3+esm2"
        },
        {
            "binary_name": "libpng3",
            "binary_version": "1.2.50-1ubuntu2.14.04.3+esm2"
        }
    ],
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-33416"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-34757"
        }
    ],
    "ecosystem": "Ubuntu:Pro:14.04:LTS"
}

Ubuntu:Pro:16.04:LTS

libpng

Package

Name: libpng
Purl: pkg:deb/ubuntu/libpng?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.54-1ubuntu1.1+esm3

Affected versions

1.*

1.2.51-0ubuntu3

1.2.54-1

1.2.54-1ubuntu1

1.2.54-1ubuntu1.1

1.2.54-1ubuntu1.1+esm1

1.2.54-1ubuntu1.1+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libpng12-0",
            "binary_version": "1.2.54-1ubuntu1.1+esm3"
        },
        {
            "binary_name": "libpng3",
            "binary_version": "1.2.54-1ubuntu1.1+esm3"
        }
    ],
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-33416"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-34757"
        }
    ],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}

libpng1.6

Package

Name: libpng1.6
Purl: pkg:deb/ubuntu/libpng1.6?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.20-2ubuntu0.1~esm4

Affected versions

1.*

1.6.20-2

1.6.20-2ubuntu0.1~esm1

1.6.20-2ubuntu0.1~esm2

1.6.20-2ubuntu0.1~esm3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libpng16-16",
            "binary_version": "1.6.20-2ubuntu0.1~esm4"
        },
        {
            "binary_name": "libpng16-devtools",
            "binary_version": "1.6.20-2ubuntu0.1~esm4"
        },
        {
            "binary_name": "libpng16-tools",
            "binary_version": "1.6.20-2ubuntu0.1~esm4"
        }
    ],
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2016-10087"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2019-7317"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-33416"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-34757"
        }
    ],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}

Ubuntu:Pro:18.04:LTS

libpng1.6

Package

Name: libpng1.6
Purl: pkg:deb/ubuntu/libpng1.6?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.34-1ubuntu0.18.04.2+esm3

Affected versions

1.*

1.6.34-1

1.6.34-1ubuntu0.18.04.1

1.6.34-1ubuntu0.18.04.2

1.6.34-1ubuntu0.18.04.2+esm1

1.6.34-1ubuntu0.18.04.2+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libpng-tools",
            "binary_version": "1.6.34-1ubuntu0.18.04.2+esm3"
        },
        {
            "binary_name": "libpng16-16",
            "binary_version": "1.6.34-1ubuntu0.18.04.2+esm3"
        }
    ],
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "low",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2018-14048"
        },
        {
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ],
            "id": "CVE-2026-33416"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
                },
                {
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                    "type": "CVSS_V3"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-34757"
        }
    ],
    "ecosystem": "Ubuntu:Pro:18.04:LTS"
}

Ubuntu:Pro:20.04:LTS

libpng1.6

Package

Name: libpng1.6
Purl: pkg:deb/ubuntu/libpng1.6?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.37-2ubuntu0.1~esm3

Affected versions

1.*

1.6.37-1

1.6.37-2

1.6.37-2ubuntu0.1~esm1

1.6.37-2ubuntu0.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libpng-tools",
            "binary_version": "1.6.37-2ubuntu0.1~esm3"
        },
        {
            "binary_name": "libpng16-16",
            "binary_version": "1.6.37-2ubuntu0.1~esm3"
        }
    ],
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8639-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-33416"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-33636"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-34757"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-40930"
        }
    ],
    "ecosystem": "Ubuntu:Pro:20.04:LTS"
}