QSN-8639-1: libpng vulnerabilities
2026-08-17

Summary:
Several security issues were fixed in libpng.

Details:
Patrick Keshishian discovered that libpng incorrectly handled certain
text chunks. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10087)

It was discovered that libpng incorrectly handled certain malformed
images. An attacker could possibly use this issue to cause a denial of
service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-14048)

It was discovered that libpng incorrectly handled memory when freeing
certain images. An attacker could possibly use this issue to cause
a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2019-7317)

It was discovered that libpng incorrectly handled memory when
processing certain images. An attacker could possibly use this issue
to cause a denial of service, or execute arbitrary code. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu
20.04 LTS. (CVE-2026-33416)

It was discovered that libpng incorrectly handled certain images. An
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2026-33636)

It was discovered that libpng incorrectly handled memory when
processing certain images. An attacker could possibly use this issue
to cause a denial of service or obtain sensitive information. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2026-34757)

Seung Min Shin discovered that libpng incorrectly handled certain
animated images. An attacker could possibly use this issue to cause
libpng to misinterpret image data. This issue only affected Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2026-40930)

Affected QuantaStor releases:
  6.9.1.001 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)
  6.9.0.464 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)
  6.8.6.015 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)
  6.8.5.018 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)
  6.8.4.038 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)
  6.8.3.018 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)
  6.8.2.002 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)
  6.8.1.007 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)
  6.8.0.205 jammy: libpng16-16 1.6.37-3build5 (fixed in 1.6.37-3ubuntu0.6)

CVEs: CVE-2019-7317, CVE-2026-33416, CVE-2026-40930, CVE-2016-10087, CVE-2026-34757, CVE-2026-33636, CVE-2018-14048

References:
  https://ubuntu.com/security/notices/USN-8639-1