VDB
GHSA-7qhq-6293-wrx3
GHSA-7qhq-6293-wrx3
PUBLISHED
CVSS 8.800000190734863 HIGH
Record from GitHub Advisory Database · Published May 13, 2022
Integer underflow in the png_check_keyword function in pngwutil.c in libpng 0.90 through 0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x and 1.4.x before 1.4.19, and 1.5.x before 1.5.26 allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read.
Risk scores
CVSS 3.0
8.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
- May 13, 2022 CVE Published
- Apr 9, 2026 Distribution Patch (2 in total, the first dated here)
- Apr 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-7qhq-6293-wrx3
vulnetix vdb fixes GHSA-7qhq-6293-wrx3Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-7qhq-6293-wrx3/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-8540 advisory
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E url
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E url
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E url
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E url
- http://sourceforge.net/p/libpng/bugs/244 url
- http://sourceforge.net/projects/libpng/files/libpng14/1.4.19 url
- http://www.openwall.com/lists/oss-security/2015/12/10/6 url
- http://www.openwall.com/lists/oss-security/2015/12/17/10 url
- http://www.securityfocus.com/bid/80592 url
- https://access.redhat.com/errata/RHSA-2016:1430 url
- http://sourceforge.net/p/libpng/code/ci/d9006f683c641793252d92254a75ae9b815b42ed url
- http://sourceforge.net/projects/libpng/files/libpng10/1.0.66 url
- https://security.gentoo.org/glsa/201611-08 url
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174435.html url
- http://sourceforge.net/projects/libpng/files/libpng12/1.2.56 url
- http://sourceforge.net/projects/libpng/files/libpng15/1.5.26 url
- http://www.debian.org/security/2016/dsa-3443 url
- http://www.openwall.com/lists/oss-security/2015/12/10/7 url
- http://www.openwall.com/lists/oss-security/2015/12/11/1 url
…and 2 more