ELSA-2026-43702

ELSA-2026-43702 - libpng12 security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-08-08

Description

[1.2.50-10.0.3]
- Fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and
png_set_PLTE [Orabug: 39771480]

[1.2.50-10.0.1]
- Fix CVE-2026-25646: heap buffer overflow in png_set_quantize [Orabug: 39183864]

Related CVEs

CVE-2026-33416

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 7 (x86_64)	libpng12-1.2.50-10.0.3.el7.src.rpm	8e29f803d745660d9db12bce009212c72306da2572f7a0f522958deb6d7cec81	-	ol7_x86_64_latest_ELS
	libpng12-1.2.50-10.0.3.el7.i686.rpm	3a0752220df019f4dad49f06214e8dfba184c2b662c89c896a14f3633edc56a0	-	ol7_x86_64_latest_ELS
	libpng12-1.2.50-10.0.3.el7.x86_64.rpm	094928f1a3b383230a3430d8049c6841b36ab8464e3f932098a884599639bb42	-	ol7_x86_64_latest_ELS
	libpng12-devel-1.2.50-10.0.3.el7.i686.rpm	fc94937c7e750dc03f877c1847d40566199e6053e91c08979248dafd2173ca53	-	ol7_x86_64_latest_ELS
	libpng12-devel-1.2.50-10.0.3.el7.x86_64.rpm	20392e6015f124026a28dd30dc8045639c768d8a1899314aa9c598bb22d3114f	-	ol7_x86_64_latest_ELS

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team