CVE-2019-7317: Canonical Ubuntu Linux

Medium severity, CVSS 5.3. EPSS: 9.4% chance of exploitation in the next 30 days.

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 18.10 only; version 19.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• HP XP7 Command View: before 8.7.0-00 (fixed in 8.7.0-00)
• HPE XP7 Command View Advanced Edition Suite: before 8.7.0-00 (fixed in 8.7.0-00)
• Libpng Libpng: from 1.6.0, before 1.6.37 (fixed in 1.6.37)
• Mozilla Firefox: affected versions not specified
• Mozilla Thunderbird: affected versions not specified
• Netapp Active Iq Unified Manager: before 9.6 (fixed in 9.6); version 9.6 only
• Netapp Cloud Backup: affected versions not specified
• Netapp E-Series Santricity Management: affected versions not specified
• Netapp E-Series Santricity Storage Manager: before 11.53 (fixed in 11.53)
• Netapp E-Series Santricity Unified Manager: before 3.2 (fixed in 3.2)
• Netapp E-Series Santricity Web Services: before 4.0 (fixed in 4.0)
• Netapp Oncommand Insight: before 7.3.9 (fixed in 7.3.9)
• Netapp Oncommand Workflow Automation: before 5.1 (fixed in 5.1)
• Netapp Plug-In For Symantec Netbackup: affected versions not specified
• Netapp Snapmanager: before 3.4.2 (fixed in 3.4.2); version 3.4.2 only
• Netapp Steelstore: affected versions not specified
• Opensuse Leap: version 15.0 only; version 15.1 only; version 42.3 only
• Opensuse Package Hub: affected versions not specified
• Oracle Hyperion Infrastructure Technology: version 11.2.6.0 only
• Oracle Java SE: version 7u221 only; version 8u212 only
• Oracle JDK: version 11.0.3 only; version 12.0.1 only
• Oracle MySQL: before 8.0.23 (fixed in 8.0.23)
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only; version 8.0 only
• and 7 more

Published 2019-02-04. Last modified 2026-06-17.