CVE-2019-6129
Fixed in a distro release EPSS 2%CVSS 6.5
png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer.
Products: libpng
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libpng1.6 | 1.6.39-1 |
| Debian 13 | libpng1.6 | 1.6.39-1 |
| Debian 14 | libpng1.6 | 1.6.39-1 |
| Ubuntu Pro 14.04 LTS | libpng | no fix |
| Ubuntu Pro 16.04 LTS | libpng | no fix |
| Ubuntu Pro 16.04 LTS | libpng1.6 | no fix |
| Ubuntu Pro 18.04 LTS | libpng1.6 | no fix |
| openSUSE Tumbleweed | libpng16 | 1.6.40-2.1 |