Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.

• http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html
• http://code.google.com/p/chromium/issues/detail?id=116162
• http://src.chromium.org/viewvc/chrome?view=rev&revision=125311
• http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng/libpng;a=commit;h=a8c319a2b281af68f7ca0e2f9a28ca57b44ceb2b
• https://bugzilla.redhat.com/show_bug.cgi?id=799000
• http://secunia.com/advisories/48485
• http://secunia.com/advisories/48512
• http://secunia.com/advisories/48554
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076731.html
• http://secunia.com/advisories/48320
• http://lists.opensuse.org/opensuse-updates/2012-03/msg00051.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076461.html
• http://secunia.com/advisories/49660
• http://security.gentoo.org/glsa/glsa-201206-15.xml
• http://www.securitytracker.com/id?1026823
• http://rhn.redhat.com/errata/RHSA-2012-0488.html
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14763
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:033
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075987.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075981.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075619.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075424.html
• http://www.debian.org/security/2012/dsa-2439
• http://rhn.redhat.com/errata/RHSA-2012-0407.html
• http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html

The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

• http://www.redhat.com/support/errata/RHSA-2002-026.html
• http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-023.php
• http://www.redhat.com/support/errata/RHSA-2002-027.html
• http://www.cert.org/advisories/CA-2002-07.html
• http://www.kb.cert.org/vuls/id/368819
• http://www.debian.org/security/2002/dsa-122
• http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:022
• http://www.caldera.com/support/security/advisories/CSSA-2002-014.1.txt
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-015.1.txt
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000469
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-030
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-036
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBTL0204-037
• http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-024.php3
• http://www.securityfocus.com/bid/4267
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8427

The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.

• http://www.openwall.com/lists/oss-security/2016/12/30/4
• http://www.openwall.com/lists/oss-security/2016/12/29/2
• http://www.securityfocus.com/bid/95157
• https://security.gentoo.org/glsa/201701-74
• https://usn.ubuntu.com/3712-2/
• https://usn.ubuntu.com/3712-1/
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E

libpng before 1.6.32 does not properly check the length of chunks against the user limit.

• https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE
• http://www.securityfocus.com/bid/109269
• https://support.f5.com/csp/article/K88124225
• https://support.f5.com/csp/article/K88124225?utm_source=f5support&utm_medium=RSS
• https://security.netapp.com/advisory/ntap-20220506-0003/