CVE-2012-3425: Canonical Ubuntu Linux

Medium severity, CVSS 4.3. EPSS: 3.4% chance of exploitation in the next 30 days.

The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.04 only; version 15.10 only
• Debian Debian Linux: version 6.0 only
• Libpng Libpng: version 1.4.0 only; version 1.4.1 only; version 1.4.2 only; version 1.4.3 only; version 1.4.4 only; version 1.4.5 only; …
• Opensuse Opensuse: version 11.4 only; version 12.1 only
• Red Hat Libpng: version 1.2.2-16 only; version 1.2.2-20 only

Published 2012-08-13. Last modified 2026-06-16.