The pngsettext_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "libpng12-0-udeb-dbgsym": "1.2.50-1ubuntu2.14.04.3", "libpng12-0-dbgsym": "1.2.50-1ubuntu2.14.04.3", "libpng12-dev": "1.2.50-1ubuntu2.14.04.3", "libpng3": "1.2.50-1ubuntu2.14.04.3", "libpng12-0": "1.2.50-1ubuntu2.14.04.3", "libpng12-0-udeb": "1.2.50-1ubuntu2.14.04.3" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "libpng12-0-udeb-dbgsym": "1.2.54-1ubuntu1.1", "libpng12-0-dbgsym": "1.2.54-1ubuntu1.1", "libpng12-dev": "1.2.54-1ubuntu1.1", "libpng3": "1.2.54-1ubuntu1.1", "libpng12-0": "1.2.54-1ubuntu1.1", "libpng12-0-udeb": "1.2.54-1ubuntu1.1" } ] }