High severity7.3NVD Advisory· Published Jan 21, 2016· Updated Jun 17, 2026
CVE-2015-8472
CVE-2015-8472
Description
Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
141cpe:2.3:a:libpng:libpng:1.0.64:*:*:*:*:*:*:*+ 113 more
- cpe:2.3:a:libpng:libpng:1.0.64:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.15:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.17:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.18:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.19:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.20:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.21:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.22:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.23:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.24:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.25:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.26:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.27:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.28:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.29:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.30:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.31:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.32:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.33:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.34:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.35:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.36:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.37:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.38:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.39:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.40:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.41:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.42:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.43:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.44:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.45:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.46:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.47:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.48:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.49:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.50:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.51:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.52:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.53:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.2.54:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.15:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.16:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.17:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.10:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.11:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.12:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.13:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.14:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.15:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.16:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.17:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.18:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.19:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.20:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.21:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.22:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.23:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.24:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.5.9:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.12:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.13:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.14:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.15:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.16:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.17:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.18:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.19:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:libpng:libpng:1.6.9:*:*:*:*:*:*:*
- (no CPE)range: <1.6.20
- osv-coords26 versionspkg:rpm/opensuse/java-1_7_0-openjdk&distro=openSUSE%20Tumbleweedpkg:rpm/suse/java-1_6_0-ibm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2012pkg:rpm/suse/java-1_6_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP2-LTSSpkg:rpm/suse/java-1_6_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSSpkg:rpm/suse/java-1_7_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP2-LTSSpkg:rpm/suse/java-1_7_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSSpkg:rpm/suse/java-1_7_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP3pkg:rpm/suse/java-1_7_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP4pkg:rpm/suse/java-1_7_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Desktop%2012pkg:rpm/suse/java-1_7_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1pkg:rpm/suse/java-1_7_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2012pkg:rpm/suse/java-1_7_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1pkg:rpm/suse/java-1_7_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012pkg:rpm/suse/java-1_7_0-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2012pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012pkg:rpm/suse/java-1_7_1-ibm&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1
< 1.7.0.121-1.1+ 25 more
- (no CPE)range: < 1.7.0.121-1.1
- (no CPE)range: < 1.6.0_sr16.20-30.1
- (no CPE)range: < 1.6.0_sr16.20-49.1
- (no CPE)range: < 1.6.0_sr16.20-51.1
- (no CPE)range: < 1.7.0_sr9.30-45.1
- (no CPE)range: < 1.7.0_sr9.30-47.1
- (no CPE)range: < 1.7.0.95-0.17.2
- (no CPE)range: < 1.7.0.95-0.17.2
- (no CPE)range: < 1.7.0.95-24.2
- (no CPE)range: < 1.7.0.95-24.2
- (no CPE)range: < 1.7.0.95-24.2
- (no CPE)range: < 1.7.0.95-24.2
- (no CPE)range: < 1.7.0.95-24.2
- (no CPE)range: < 1.7.0.95-24.2
- (no CPE)range: < 1.7.1_sr3.30-9.1
- (no CPE)range: < 1.7.1_sr3.30-21.1
- (no CPE)range: < 1.7.1_sr3.30-21.1
- (no CPE)range: < 1.7.1_sr3.30-9.1
- (no CPE)range: < 1.7.1_sr3.30-21.1
- (no CPE)range: < 1.7.1_sr3.30-21.1
- (no CPE)range: < 1.7.1_sr3.30-9.1
- (no CPE)range: < 1.7.1_sr3.30-21.1
- (no CPE)range: < 1.7.1_sr3.30-21.1
- (no CPE)range: < 1.8.0_sr2.10-7.1
- (no CPE)range: < 1.8.0_sr2.10-7.1
- (no CPE)range: < 1.8.0_sr2.10-7.1
Patches
Vulnerability mechanics
References
31- www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlnvdVendor Advisory
- support.apple.com/HT206167nvdVendor Advisory
- lists.apple.com/archives/security-announce/2016/Mar/msg00004.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2016-January/174905.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2016-January/174936.htmlnvd
- lists.fedoraproject.org/pipermail/package-announce/2016-January/175073.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-2594.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-2595.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-2596.htmlnvd
- rhn.redhat.com/errata/RHSA-2016-0055.htmlnvd
- rhn.redhat.com/errata/RHSA-2016-0056.htmlnvd
- rhn.redhat.com/errata/RHSA-2016-0057.htmlnvd
- sourceforge.net/projects/libpng/files/libpng10/1.0.65/nvd
- sourceforge.net/projects/libpng/files/libpng12/1.2.55/nvd
- sourceforge.net/projects/libpng/files/libpng14/1.4.18/nvd
- sourceforge.net/projects/libpng/files/libpng15/1.5.25/nvd
- sourceforge.net/projects/libpng/files/libpng16/1.6.20/nvd
- www.debian.org/security/2016/dsa-3443nvd
- www.openwall.com/lists/oss-security/2015/12/03/6nvd
- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlnvd
- www.securityfocus.com/bid/78624nvd
- access.redhat.com/errata/RHSA-2016:1430nvd
- kc.mcafee.com/corporate/indexnvd
News mentions
0No linked articles in our index yet.