CVE-2015-8126: Apple Mac OS X

High severity, CVSS 7.5. EPSS: 10.3% chance of exploitation in the next 30 days.

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Affected products

  • Apple Mac OS X: before 10.11.4 (fixed in 10.11.4)
  • Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.04 only; version 15.10 only
  • Debian Debian Linux: version 7.0 only; version 8.0 only; version 9.0 only
  • Fedoraproject Fedora: version 21 only; version 22 only; version 23 only
  • Libpng Libpng: before 1.0.64 (fixed in 1.0.64); from 1.1.1, before 1.2.54 (fixed in 1.2.54); from 1.3.0, before 1.4.17 (fixed in 1.4.17); from 1.5.0, before 1.5.24 (fixed in 1.5.24); from 1.6.0, before 1.6.19 (fixed in 1.6.19)
  • Opensuse Leap: version 42.1 only
  • Opensuse Opensuse: version 13.1 only; version 13.2 only
  • Oracle JDK: version 1.6.0 only; version 1.7.0 only; version 1.8.0 only
  • Oracle JRE: version 1.6.0 only; version 1.7.0 only; version 1.8.0 only
  • Oracle Linux: version 6 only; version 7 only
  • Oracle Solaris: version 11.3 only
  • Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
  • Red Hat Enterprise Linux Eus: version 6.7 only; version 7.2 only; version 7.3 only; version 7.4 only; version 7.5 only; version 7.6 only; …
  • Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
  • Red Hat Enterprise Linux Server Aus: version 7.2 only; version 7.3 only; version 7.4 only; version 7.6 only; version 7.7 only
  • Red Hat Enterprise Linux Server Tus: version 7.2 only; version 7.3 only; version 7.6 only; version 7.7 only
  • Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only
  • Red Hat Satellite: version 5.7 only; version 5.6 only
  • Suse Linux Enterprise Desktop: version 11 only; version 12 only
  • Suse Linux Enterprise Server: version 12 only

Published 2015-11-13. Last modified 2026-06-17.