Security update for libpng16
This update for libpng16 fixes the following issues: - CVE-2025-64505: heap buffer over-read in `png_do_quantize` when processing PNG files malformed palette indices (bsc#1254157). - CVE-2025-64506: heap buffer over-read in `png_write_image_8bit` when processing 8-bit input with `convert_to_8bit` enabled (bsc#1254158). - CVE-2025-64720: out-of-bounds read in `png_image_read_composite` when processing palette images with `PNG_FLAG_OPTIMIZE_ALPHA` enabled (bsc#1254159). - CVE-2025-65018: heap buffer overflow in `png_image_finish_read` when processing specially crafted 16-bit interlaced PNGs with 8-bit output format (bsc#1254160). - CVE-2025-66293: out-of-bounds read of the `png_sRGB_base` array when processing palette PNG images with partial transparency and gamma correction (bsc#1254480).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for libpng16 fixes the following issues: - CVE-2025-64505: heap buffer over-read in `png_do_quantize` when processing PNG files malformed palette indices (bsc#1254157). - CVE-2025-64506: heap buffer over-read in `png_write_image_8bit` when processing 8-bit input with `convert_to_8bit` enabled (bsc#1254158). - CVE-2025-64720: out-of-bounds read in `png_image_read_composite` when processing palette images with `PNG_FLAG_OPTIMIZE_ALPHA` enabled (bsc#1254159). - CVE-2025-65018: heap buffer overflow in `png_image_finish_read` when processing specially crafted 16-bit interlaced PNGs with 8-bit output format (bsc#1254160). - CVE-2025-66293: out-of-bounds read of the `png_sRGB_base` array when processing palette PNG images with partial transparency and gamma correction (bsc#1254480).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1254157
- https://bugzilla.suse.com/1254158
- https://bugzilla.suse.com/1254159
- https://bugzilla.suse.com/1254160
- https://bugzilla.suse.com/1254480
- https://www.suse.com/security/cve/CVE-2025-64505
- https://www.suse.com/security/cve/CVE-2025-64506
- https://www.suse.com/security/cve/CVE-2025-64720
- https://www.suse.com/security/cve/CVE-2025-65018
- https://www.suse.com/security/cve/CVE-2025-66293