PatchSiren

Libpng CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Libpng CVE published 2017-01-30

CVE-2016-10087

CVE-2016-10087 is a high-severity availability flaw in libpng. According to the CVE record, png_set_text_2 can dereference a NULL pointer when text handling reaches a specific state transition: a text chunk is loaded into a png structure, removed, and then another text chunk is added. The NVD assigns CVSS 3.0 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and CWE-476 (NULL Pointer Dereference). The issue was p [truncated]