Release date:
2026-09-02 10:14:03 UTC
Description:
* SECURITY UPDATE: chunk data smuggling in the APNG push-mode reader
- debian/patches/CVE-2026-40930.patch: consume the chunk body and the
CRC field in the three inter-frame discard paths of
png_push_read_chunk (pngpread.c), so that bytes inside an ignored
chunk are no longer reinterpreted as a fresh chunk header on the
next png_process_data call, and pass the real chunk length to
png_ensure_sequence_number in png_push_read_IDAT (pngpread.c), so
that an fdAT chunk shorter than its own sequence number no longer
underflows idat_size and swallows the rest of the stream as frame
data
- CVE-2026-40930
Updated packages:
-
libpng-dev_1.6.37-2+tuxcare.els5_amd64.deb
sha:57b6e20a1bb305eccfb40e23d8f34d315ed1ae20
-
libpng-tools_1.6.37-2+tuxcare.els5_amd64.deb
sha:022a3cb9d7dc380512fcfd05033298d1b18cf3f1
-
libpng16-16_1.6.37-2+tuxcare.els5_amd64.deb
sha:4ce92beb012708c81db658158586c9ffd24765e5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
