Release date:
2026-10-12 16:56:43 UTC
Description:
* SECURITY UPDATE: use-after-free through stale zstream pointers
- debian/patches/CVE-2026-46675.patch: add png_inflate_detach_buffers
to clear the zstream input and output pointers and counters, and
call it on claim in png_inflate_claim and on release in
png_decompress_chunk, png_handle_iCCP and png_read_finish_IDAT
(pngrutil.c), so that png_read_end called before row reading no
longer inflates through a stale next_in into a freed buffer
- CVE-2026-46675
Updated packages:
-
libpng-dev_1.6.37-2+tuxcare.els6_amd64.deb
sha:42a9af174963d2d7ba832b9498f2123d53f3712a
-
libpng-tools_1.6.37-2+tuxcare.els6_amd64.deb
sha:4ea2188e5e48c4f87d20ffef8de7633a2e6e24fc
-
libpng16-16_1.6.37-2+tuxcare.els6_amd64.deb
sha:d4acc38dace8994c91b583ab3e48b4f5365183bb
-
libpng-dev_1.6.37-2+tuxcare.els6_arm64.deb
sha:0aff140800c8ae4725d7d8a1d9a41911bf311cac
-
libpng-tools_1.6.37-2+tuxcare.els6_arm64.deb
sha:4f732a77a1dfcaeee57e6d1725644f5157436302
-
libpng16-16_1.6.37-2+tuxcare.els6_arm64.deb
sha:895ff07a0b6c30f00902d6dff0e0ffce9c1543cf
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
