CVE catalog
CVE-2015-8126
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x b
- Severity
- High · CVSS 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 10.34% · Oct 25, 2026
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | libpng | Not reported | 1.0.64 | fixed |
| Cpe | libpng | Not reported | 1.2.54 | fixed |
| Cpe | libpng | Not reported | 1.4.17 | fixed |
| Cpe | libpng | Not reported | 1.5.24 | fixed |
| Cpe | libpng | Not reported | 1.6.19 | fixed |
| Cpe | fedora | Not reported | Not reported | unknown |
| Cpe | fedora | Not reported | Not reported | unknown |
| Cpe | fedora | Not reported | Not reported | unknown |
| Cpe | leap | Not reported | Not reported | unknown |
| Cpe | opensuse | Not reported | Not reported | unknown |
| Cpe | opensuse | Not reported | Not reported | unknown |
| Cpe | linux_enterprise_desktop | Not reported | Not reported | unknown |
| Cpe | linux_enterprise_desktop | Not reported | Not reported | unknown |
| Cpe | linux_enterprise_desktop | Not reported | Not reported | unknown |
| Cpe | linux_enterprise_desktop | Not reported | Not reported | unknown |
| Cpe | linux_enterprise_server | Not reported | Not reported | unknown |
| Cpe | linux_enterprise_server | Not reported | Not reported | unknown |
| Cpe | debian_linux | Not reported | Not reported | unknown |
| Cpe | debian_linux | Not reported | Not reported | unknown |
| Cpe | debian_linux | Not reported | Not reported | unknown |
| Ubuntu | libpng | 14.04 | 1.2.49-4ubuntu1 | vulnerable |
| Ubuntu | libpng | 14.04 | 1.2.49-5ubuntu1 | vulnerable |
| Ubuntu | libpng | 14.04 | 1.2.50-1ubuntu1 | vulnerable |
| Ubuntu | libpng | 14.04 | 1.2.50-1ubuntu2 | vulnerable |
| Ubuntu | libpng | 14.04 | 1.2.50-1ubuntu2.14.04.1 | fixed |
| Debian | chromium-browser | 8 | 41.0.2272.118-1 | vulnerable |
| Debian | chromium-browser | 8 | 42.0.2311.135-1 | vulnerable |
| Debian | chromium-browser | 8 | 42.0.2311.135-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 42.0.2311.135-2 | vulnerable |
| Debian | chromium-browser | 8 | 42.0.2311.90-1 | vulnerable |
| Debian | chromium-browser | 8 | 42.0.2311.90-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 42.0.2311.90-2 | vulnerable |
| Debian | chromium-browser | 8 | 43.0.2357.124-1 | vulnerable |
| Debian | chromium-browser | 8 | 43.0.2357.124-2 | vulnerable |
| Debian | chromium-browser | 8 | 43.0.2357.124-3 | vulnerable |
| Debian | chromium-browser | 8 | 43.0.2357.130-1 | vulnerable |
| Debian | chromium-browser | 8 | 43.0.2357.65-1 | vulnerable |
| Debian | chromium-browser | 8 | 43.0.2357.65-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 43.0.2357.81-1 | vulnerable |
| Debian | chromium-browser | 8 | 44.0.2403.107-1 | vulnerable |
| Debian | chromium-browser | 8 | 44.0.2403.107-2 | vulnerable |
| Debian | chromium-browser | 8 | 44.0.2403.157-1 | vulnerable |
| Debian | chromium-browser | 8 | 44.0.2403.89-1 | vulnerable |
| Debian | chromium-browser | 8 | 44.0.2403.89-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 45.0.2454.101-1 | vulnerable |
| Debian | chromium-browser | 8 | 45.0.2454.85-1 | vulnerable |
| Debian | chromium-browser | 8 | 45.0.2454.85-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 46.0.2490.13-1 | vulnerable |
| Debian | chromium-browser | 8 | 46.0.2490.71-1 | vulnerable |
| Debian | chromium-browser | 8 | 46.0.2490.71-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 47.0.2526.111-1 | vulnerable |
| Debian | chromium-browser | 8 | 47.0.2526.16-1 | vulnerable |
| Debian | chromium-browser | 8 | 47.0.2526.73-1 | vulnerable |
| Debian | chromium-browser | 8 | 47.0.2526.73-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 47.0.2526.80-1 | vulnerable |
| Debian | chromium-browser | 8 | 47.0.2526.80-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 47.0.2526.80-2 | vulnerable |
| Debian | chromium-browser | 8 | 47.0.2526.80-3 | vulnerable |
| Debian | chromium-browser | 8 | 48.0.2564.116-1 | vulnerable |
| Debian | chromium-browser | 8 | 48.0.2564.116-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 48.0.2564.23-1 | vulnerable |
| Debian | chromium-browser | 8 | 48.0.2564.82-1 | vulnerable |
| Debian | chromium-browser | 8 | 48.0.2564.82-1~deb8u1 | vulnerable |
| Debian | chromium-browser | 8 | 48.0.2564.82-2 | vulnerable |
| Debian | chromium-browser | 8 | 49.0.2623.75-1~deb8u1 | fixed |
| Suse | libpng16 | linux enterprise desktop 12 | 1.6.8-11.1 | fixed |
| Suse | libpng16 | linux enterprise desktop 12 sp1 | 1.6.8-11.1 | fixed |
| Suse | libpng16 | linux enterprise software development kit 12 | 1.6.8-11.1 | fixed |
| Suse | libpng16 | linux enterprise software development kit 12 sp1 | 1.6.8-11.1 | fixed |
| Suse | libpng16 | linux enterprise server 12 | 1.6.8-11.1 | fixed |
| Suse | libpng16 | linux enterprise server for sap applications 12 | 1.6.8-11.1 | fixed |
| Suse | libpng16 | linux enterprise server 12 sp1 | 1.6.8-11.1 | fixed |
| Suse | libpng16 | linux enterprise server for sap applications 12 sp1 | 1.6.8-11.1 | fixed |
| Suse | libpng12 | linux enterprise desktop 12 | 1.2.50-13.1 | fixed |
| Suse | libpng12 | linux enterprise desktop 12 sp1 | 1.2.50-13.1 | fixed |
| Suse | libpng12 | linux enterprise software development kit 12 | 1.2.50-13.1 | fixed |
| Suse | libpng12 | linux enterprise software development kit 12 sp1 | 1.2.50-13.1 | fixed |
| Suse | libpng12 | linux enterprise server 12 | 1.2.50-13.1 | fixed |
| Suse | libpng12 | linux enterprise server for sap applications 12 | 1.2.50-13.1 | fixed |
| Suse | libpng12 | linux enterprise server 12 sp1 | 1.2.50-13.1 | fixed |
| Suse | libpng12 | linux enterprise server for sap applications 12 sp1 | 1.2.50-13.1 | fixed |
| Suse | libpng15 | linux enterprise desktop 12 sp1 | 1.5.22-4.1 | fixed |
| Suse | libpng15 | linux enterprise server 12 sp1 | 1.5.22-4.1 | fixed |
| Suse | libpng15 | linux enterprise server for sap applications 12 sp1 | 1.5.22-4.1 | fixed |
| Suse | libpng16 | linux enterprise desktop 12 | 1.6.8-8.1 | fixed |
| Suse | libpng16 | linux enterprise software development kit 12 | 1.6.8-8.1 | fixed |
| Suse | libpng16 | linux enterprise server 12 | 1.6.8-8.1 | fixed |
| Suse | libpng16 | linux enterprise server for sap applications 12 | 1.6.8-8.1 | fixed |
| Suse | libpng12-0 | linux enterprise software development kit 11 sp3 | 1.2.31-5.38.1 | fixed |
| Suse | libpng12-0 | linux enterprise software development kit 11 sp4 | 1.2.31-5.38.1 | fixed |
| Suse | libpng12-0 | linux enterprise desktop 11 sp3 | 1.2.31-5.38.1 | fixed |
| Suse | libpng12-0 | linux enterprise desktop 11 sp4 | 1.2.31-5.38.1 | fixed |
| Suse | libpng12-0 | linux enterprise server 11 sp3 | 1.2.31-5.38.1 | fixed |
| Suse | libpng12-0 | linux enterprise server 11 sp3-teradata | 1.2.31-5.38.1 | fixed |
| Suse | libpng12-0 | linux enterprise server for sap applications 11 sp3 | 1.2.31-5.38.1 | fixed |
| Suse | libpng12-0 | linux enterprise server 11 sp4 | 1.2.31-5.38.1 | fixed |
| Suse | libpng12-0 | linux enterprise server for sap applications 11 sp4 | 1.2.31-5.38.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | libpng | cpe | Not reported | 1.0.64 | Not reported | NVD-CVE-2015-8126 | Not reported |
| Cpe | libpng | cpe | Not reported | 1.2.54 | Not reported | NVD-CVE-2015-8126 | Not reported |
| Cpe | libpng | cpe | Not reported | 1.4.17 | Not reported | NVD-CVE-2015-8126 | Not reported |
| Cpe | libpng | cpe | Not reported | 1.5.24 | Not reported | NVD-CVE-2015-8126 | Not reported |
| Cpe | libpng | cpe | Not reported | 1.6.19 | Not reported | NVD-CVE-2015-8126 | Not reported |
| Ubuntu | libpng | deb | 14.04 | 1.2.50-1ubuntu2.14.04.1 | Not reported | UBUNTU-CVE-2015-8126 | Not reported |
| Debian | chromium-browser | deb | 8 | 49.0.2623.75-1~deb8u1 | Not reported | DSA-3507-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise desktop 12 | 1.6.8-11.1 | Not reported | SUSE-SU-2016:0027-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise desktop 12 sp1 | 1.6.8-11.1 | Not reported | SUSE-SU-2016:0027-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise software development kit 12 | 1.6.8-11.1 | Not reported | SUSE-SU-2016:0027-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise software development kit 12 sp1 | 1.6.8-11.1 | Not reported | SUSE-SU-2016:0027-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise server 12 | 1.6.8-11.1 | Not reported | SUSE-SU-2016:0027-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise server for sap applications 12 | 1.6.8-11.1 | Not reported | SUSE-SU-2016:0027-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise server 12 sp1 | 1.6.8-11.1 | Not reported | SUSE-SU-2016:0027-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise server for sap applications 12 sp1 | 1.6.8-11.1 | Not reported | SUSE-SU-2016:0027-1 | Not reported |
| Suse | libpng12 | rpm | linux enterprise desktop 12 | 1.2.50-13.1 | Not reported | SUSE-SU-2016:0050-1 | Not reported |
| Suse | libpng12 | rpm | linux enterprise desktop 12 sp1 | 1.2.50-13.1 | Not reported | SUSE-SU-2016:0050-1 | Not reported |
| Suse | libpng12 | rpm | linux enterprise software development kit 12 | 1.2.50-13.1 | Not reported | SUSE-SU-2016:0050-1 | Not reported |
| Suse | libpng12 | rpm | linux enterprise software development kit 12 sp1 | 1.2.50-13.1 | Not reported | SUSE-SU-2016:0050-1 | Not reported |
| Suse | libpng12 | rpm | linux enterprise server 12 | 1.2.50-13.1 | Not reported | SUSE-SU-2016:0050-1 | Not reported |
| Suse | libpng12 | rpm | linux enterprise server for sap applications 12 | 1.2.50-13.1 | Not reported | SUSE-SU-2016:0050-1 | Not reported |
| Suse | libpng12 | rpm | linux enterprise server 12 sp1 | 1.2.50-13.1 | Not reported | SUSE-SU-2016:0050-1 | Not reported |
| Suse | libpng12 | rpm | linux enterprise server for sap applications 12 sp1 | 1.2.50-13.1 | Not reported | SUSE-SU-2016:0050-1 | Not reported |
| Suse | libpng15 | rpm | linux enterprise desktop 12 sp1 | 1.5.22-4.1 | Not reported | SUSE-SU-2016:0041-1 | Not reported |
| Suse | libpng15 | rpm | linux enterprise server 12 sp1 | 1.5.22-4.1 | Not reported | SUSE-SU-2016:0041-1 | Not reported |
| Suse | libpng15 | rpm | linux enterprise server for sap applications 12 sp1 | 1.5.22-4.1 | Not reported | SUSE-SU-2016:0041-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise desktop 12 | 1.6.8-8.1 | Not reported | SUSE-SU-2015:2013-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise software development kit 12 | 1.6.8-8.1 | Not reported | SUSE-SU-2015:2013-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise server 12 | 1.6.8-8.1 | Not reported | SUSE-SU-2015:2013-1 | Not reported |
| Suse | libpng16 | rpm | linux enterprise server for sap applications 12 | 1.6.8-8.1 | Not reported | SUSE-SU-2015:2013-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise software development kit 11 sp3 | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise software development kit 11 sp4 | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise desktop 11 sp3 | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise desktop 11 sp4 | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise server 11 sp3 | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise server 11 sp3-teradata | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise server for sap applications 11 sp3 | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise server 11 sp4 | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
| Suse | libpng12-0 | rpm | linux enterprise server for sap applications 11 sp4 | 1.2.31-5.38.1 | Not reported | SUSE-SU-2016:0061-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2015_2595.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2015-8126]
- [https://osv.dev/vulnerability/DSA-3507-1]
- [https://osv.dev/vulnerability/SUSE-SU-2015:2013-1]
- [https://osv.dev/vulnerability/SUSE-SU-2016:0027-1]
- [https://osv.dev/vulnerability/SUSE-SU-2016:0041-1]
- [https://osv.dev/vulnerability/SUSE-SU-2016:0050-1]
- [https://osv.dev/vulnerability/SUSE-SU-2016:0061-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2015-8126]
- [https://security.access.redhat.com/data/csaf/v2/vex/2015/cve-2015-8126.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0915.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]