{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","type":"nuget","namespace":"","name":"libpng","version":"1.6.18.1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"1.6.37","latest_non_vulnerable_version":"1.6.37","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38155?format=json","vulnerability_id":"VCID-fmt1-496f-9qf3","summary":"Privilege Escalation\nUnspecified vulnerability in libpng, as used in Android , allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3751","reference_id":"","reference_type":"","scores":[{"value":"0.00135","scoring_system":"epss","scoring_elements":"0.32983","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-3751"},{"reference_url":"http://source.android.com/security/bulletin/2016-07-01.html","reference_id":"","reference_type":"","scores":[],"url":"http://source.android.com/security/bulletin/2016-07-01.html"},{"reference_url":"http://www.openwall.com/lists/oss-security/2016/07/09/4","reference_id":"","reference_type":"","scores":[],"url":"http://www.openwall.com/lists/oss-security/2016/07/09/4"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3751","reference_id":"CVE-2016-3751","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3751"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52400?format=json","purl":"pkg:nuget/libpng@1.6.19.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.19.1"}],"aliases":["CVE-2016-3751"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fmt1-496f-9qf3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38465?format=json","vulnerability_id":"VCID-y21n-ekwz-ayep","summary":"NULL Pointer Dereference\nThe png_set_text_2 function in libpng  allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-10087.json","reference_id":"","reference_type":"","scores":[{"value":"3.3","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-10087.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2016-10087","reference_id":"","reference_type":"","scores":[{"value":"0.00926","scoring_system":"epss","scoring_elements":"0.76414","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2016-10087"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1409617","reference_id":"1409617","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1409617"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849799","reference_id":"849799","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849799"},{"reference_url":"https://security.archlinux.org/ASA-201701-2","reference_id":"ASA-201701-2","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201701-2"},{"reference_url":"https://security.archlinux.org/ASA-201701-5","reference_id":"ASA-201701-5","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201701-5"},{"reference_url":"https://security.archlinux.org/AVG-119","reference_id":"AVG-119","reference_type":"","scores":[{"value":"Low","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-119"},{"reference_url":"https://security.archlinux.org/AVG-120","reference_id":"AVG-120","reference_type":"","scores":[{"value":"Low","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-120"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10087","reference_id":"CVE-2016-10087","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10087"},{"reference_url":"https://security.gentoo.org/glsa/201701-74","reference_id":"GLSA-201701-74","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201701-74"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/208769?format=json","purl":"pkg:nuget/libpng@1.6.26.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-yk3y-m6rn-ukbd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.26.1"},{"url":"http://public2.vulnerablecode.io/api/packages/53246?format=json","purl":"pkg:nuget/libpng@1.6.28.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-yk3y-m6rn-ukbd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.28.1"}],"aliases":["CVE-2016-10087"],"risk_score":1.5,"exploitability":"0.5","weighted_severity":"3.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-y21n-ekwz-ayep"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/41162?format=json","vulnerability_id":"VCID-yk3y-m6rn-ukbd","summary":"Improper Input Validation\nlibpng does not properly check the length of chunks against the user limit.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12652.json","reference_id":"","reference_type":"","scores":[{"value":"3.7","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12652.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12652","reference_id":"","reference_type":"","scores":[{"value":"0.00609","scoring_system":"epss","scoring_elements":"0.70122","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-12652"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1733956","reference_id":"1733956","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1733956"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12652","reference_id":"CVE-2017-12652","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12652"},{"reference_url":"https://access.redhat.com/errata/RHSA-2020:3901","reference_id":"RHSA-2020:3901","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2020:3901"}],"fixed_packages":[],"aliases":["CVE-2017-12652"],"risk_score":1.6,"exploitability":"0.5","weighted_severity":"3.3","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yk3y-m6rn-ukbd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37940?format=json","vulnerability_id":"VCID-z7uy-uene-gkb8","summary":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nMultiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng  allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8126.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8126.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8126","reference_id":"","reference_type":"","scores":[{"value":"0.05157","scoring_system":"epss","scoring_elements":"0.90058","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8126"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7981","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7981"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8126","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8126"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281756","reference_id":"1281756","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281756"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8126","reference_id":"CVE-2015-8126","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8126"},{"reference_url":"https://security.gentoo.org/glsa/201611-08","reference_id":"GLSA-201611-08","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201611-08"},{"reference_url":"https://access.redhat.com/errata/RHSA-2015:2594","reference_id":"RHSA-2015:2594","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2015:2594"},{"reference_url":"https://access.redhat.com/errata/RHSA-2015:2595","reference_id":"RHSA-2015:2595","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2015:2595"},{"reference_url":"https://access.redhat.com/errata/RHSA-2015:2596","reference_id":"RHSA-2015:2596","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2015:2596"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0055","reference_id":"RHSA-2016:0055","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0055"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0056","reference_id":"RHSA-2016:0056","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0056"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0057","reference_id":"RHSA-2016:0057","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0057"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0098","reference_id":"RHSA-2016:0098","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0098"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0099","reference_id":"RHSA-2016:0099","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0099"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0100","reference_id":"RHSA-2016:0100","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0100"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0101","reference_id":"RHSA-2016:0101","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0101"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1430","reference_id":"RHSA-2016:1430","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:1430"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52400?format=json","purl":"pkg:nuget/libpng@1.6.19.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.19.1"}],"aliases":["CVE-2015-8126"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-z7uy-uene-gkb8"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37438?format=json","vulnerability_id":"VCID-4se8-jgv9-f3cb","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\nThe png_set_text_2 function in pngset.c in libpng  allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3048.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3048.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3048","reference_id":"","reference_type":"","scores":[{"value":"0.16887","scoring_system":"epss","scoring_elements":"0.95082","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3048"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=808139","reference_id":"808139","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=808139"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3048","reference_id":"CVE-2011-3048","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3048"},{"reference_url":"https://security.gentoo.org/glsa/201206-15","reference_id":"GLSA-201206-15","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201206-15"},{"reference_url":"https://access.redhat.com/errata/RHSA-2012:0523","reference_id":"RHSA-2012:0523","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2012:0523"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2011-3048"],"risk_score":0.1,"exploitability":"0.5","weighted_severity":"0.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4se8-jgv9-f3cb"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37625?format=json","vulnerability_id":"VCID-54s1-pkq4-aqhu","summary":"Uncontrolled Resource Consumption\nThe png_do_expand_palette function in libpng allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (1) a PLTE chunk of zero bytes or (2) a NULL palette, related to pngrtran.c and pngset.c.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6954.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6954.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-6954","reference_id":"","reference_type":"","scores":[{"value":"0.03546","scoring_system":"epss","scoring_elements":"0.87894","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-6954"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6954","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6954"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0429","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0429"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0446","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0446"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0451","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0451"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0452","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0452"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0453","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0453"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0454","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0454"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0455","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0455"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0456","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0456"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0457","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0457"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0458","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0458"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0459","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0459"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0460","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0460"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0461","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0461"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1876","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1876"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2397","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2397"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2398","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2398"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2402","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2402"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2403","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2403"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2412","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2412"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2413","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2413"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2414","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2414"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2421","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2421"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2423","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2423"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2427","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2427"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1045561","reference_id":"1045561","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1045561"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6954","reference_id":"CVE-2013-6954","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6954"},{"reference_url":"https://security.gentoo.org/glsa/201406-32","reference_id":"GLSA-201406-32","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201406-32"},{"reference_url":"https://access.redhat.com/errata/RHSA-2014:0412","reference_id":"RHSA-2014:0412","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2014:0412"},{"reference_url":"https://access.redhat.com/errata/RHSA-2014:0413","reference_id":"RHSA-2014:0413","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2014:0413"},{"reference_url":"https://access.redhat.com/errata/RHSA-2014:0486","reference_id":"RHSA-2014:0486","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2014:0486"},{"reference_url":"https://access.redhat.com/errata/RHSA-2014:0508","reference_id":"RHSA-2014:0508","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2014:0508"},{"reference_url":"https://access.redhat.com/errata/RHSA-2014:0705","reference_id":"RHSA-2014:0705","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2014:0705"},{"reference_url":"https://access.redhat.com/errata/RHSA-2014:0982","reference_id":"RHSA-2014:0982","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2014:0982"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2013-6954"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-54s1-pkq4-aqhu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37642?format=json","vulnerability_id":"VCID-8dc9-x82x-2yg1","summary":"Uncontrolled Resource Consumption\nThe png_push_read_chunk function in pngpread.c in the progressive decoder in libpng allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0333.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-0333.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0333","reference_id":"","reference_type":"","scores":[{"value":"0.00764","scoring_system":"epss","scoring_elements":"0.73778","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-0333"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1070985","reference_id":"1070985","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1070985"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0333","reference_id":"CVE-2014-0333","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0333"},{"reference_url":"https://security.gentoo.org/glsa/201408-06","reference_id":"GLSA-201408-06","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201408-06"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2014-0333"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8dc9-x82x-2yg1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37411?format=json","vulnerability_id":"VCID-8t7j-kq5w-3kd3","summary":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')\nBuffer overflow in libpng , when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-2690.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-2690.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2690","reference_id":"","reference_type":"","scores":[{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79716","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2690"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=720607","reference_id":"720607","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=720607"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2690","reference_id":"CVE-2011-2690","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2690"},{"reference_url":"https://security.gentoo.org/glsa/201206-15","reference_id":"GLSA-201206-15","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201206-15"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:1104","reference_id":"RHSA-2011:1104","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:1104"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:1105","reference_id":"RHSA-2011:1105","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:1105"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2011-2690"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8t7j-kq5w-3kd3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37408?format=json","vulnerability_id":"VCID-97n4-usr2-m3b1","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\nThe png_handle_sCAL function in pngrutil.c in libpng  does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-2692.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-2692.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2692","reference_id":"","reference_type":"","scores":[{"value":"0.07473","scoring_system":"epss","scoring_elements":"0.91912","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2692"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=720612","reference_id":"720612","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=720612"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2692","reference_id":"CVE-2011-2692","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2692"},{"reference_url":"https://security.gentoo.org/glsa/201206-15","reference_id":"GLSA-201206-15","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201206-15"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:1103","reference_id":"RHSA-2011:1103","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:1103"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:1104","reference_id":"RHSA-2011:1104","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:1104"},{"reference_url":"https://access.redhat.com/errata/RHSA-2011:1105","reference_id":"RHSA-2011:1105","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2011:1105"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2011-2692"],"risk_score":0.1,"exploitability":"0.5","weighted_severity":"0.1","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-97n4-usr2-m3b1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37679?format=json","vulnerability_id":"VCID-9whv-nakg-7uep","summary":"Heap-based Buffer Overflow\nInteger overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-7353.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-7353.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-7353","reference_id":"","reference_type":"","scores":[{"value":"0.00412","scoring_system":"epss","scoring_elements":"0.61804","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-7353"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086514","reference_id":"1086514","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086514"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7353","reference_id":"CVE-2013-7353","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7353"},{"reference_url":"https://security.gentoo.org/glsa/201408-06","reference_id":"GLSA-201408-06","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201408-06"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2013-7353"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9whv-nakg-7uep"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37794?format=json","vulnerability_id":"VCID-a899-g3pw-aqfj","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\nBuffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-0973.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-0973.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0973","reference_id":"","reference_type":"","scores":[{"value":"0.02006","scoring_system":"epss","scoring_elements":"0.84007","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-0973"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1177327","reference_id":"1177327","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1177327"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773823","reference_id":"773823","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773823"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775673","reference_id":"775673","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775673"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0973","reference_id":"CVE-2015-0973","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0973"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2015-0973"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-a899-g3pw-aqfj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37403?format=json","vulnerability_id":"VCID-bem6-n5ch-j3c4","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\npngrtran.c in libpng allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted palette-based PNG image that triggers a buffer overflow, related to the png_do_expand_palette function, the png_do_rgb_to_gray function, and an integer underflow. NOTE: some of these details are obtained from third party information.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-0408.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-0408.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-0408","reference_id":"","reference_type":"","scores":[{"value":"0.05904","scoring_system":"epss","scoring_elements":"0.9077","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-0408"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=671502","reference_id":"671502","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=671502"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0408","reference_id":"CVE-2011-0408","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0408"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2011-0408"],"risk_score":0.1,"exploitability":"0.5","weighted_severity":"0.1","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bem6-n5ch-j3c4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38009?format=json","vulnerability_id":"VCID-fhu5-ad1t-bubx","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\nBuffer overflow in the png_set_PLTE function in libpng  allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8472.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8472.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8472","reference_id":"","reference_type":"","scores":[{"value":"0.04094","scoring_system":"epss","scoring_elements":"0.8878","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8472"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8540","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8540"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281756","reference_id":"1281756","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1281756"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807112","reference_id":"807112","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807112"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8472","reference_id":"CVE-2015-8472","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8472"},{"reference_url":"https://access.redhat.com/errata/RHSA-2015:2594","reference_id":"RHSA-2015:2594","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2015:2594"},{"reference_url":"https://access.redhat.com/errata/RHSA-2015:2595","reference_id":"RHSA-2015:2595","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2015:2595"},{"reference_url":"https://access.redhat.com/errata/RHSA-2015:2596","reference_id":"RHSA-2015:2596","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2015:2596"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0055","reference_id":"RHSA-2016:0055","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0055"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0056","reference_id":"RHSA-2016:0056","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0056"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0057","reference_id":"RHSA-2016:0057","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0057"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0098","reference_id":"RHSA-2016:0098","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0098"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0099","reference_id":"RHSA-2016:0099","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0099"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0100","reference_id":"RHSA-2016:0100","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0100"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0101","reference_id":"RHSA-2016:0101","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0101"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1430","reference_id":"RHSA-2016:1430","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:1430"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2015-8472"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fhu5-ad1t-bubx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37409?format=json","vulnerability_id":"VCID-m97q-c2fu-7kd9","summary":"NULL Pointer Dereference\nThe png_err function in pngerror.c in libpng  makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-2691.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-2691.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2691","reference_id":"","reference_type":"","scores":[{"value":"0.07693","scoring_system":"epss","scoring_elements":"0.92057","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-2691"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=720608","reference_id":"720608","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=720608"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2691","reference_id":"CVE-2011-2691","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2691"},{"reference_url":"https://security.gentoo.org/glsa/201206-15","reference_id":"GLSA-201206-15","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201206-15"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2011-2691"],"risk_score":0.1,"exploitability":"0.5","weighted_severity":"0.1","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-m97q-c2fu-7kd9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37450?format=json","vulnerability_id":"VCID-nyc6-h81f-rqav","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\nThe png_push_read_zTXt function in pngpread.c in libpng  allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3425.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3425.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2012-3425","reference_id":"","reference_type":"","scores":[{"value":"0.03231","scoring_system":"epss","scoring_elements":"0.87308","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2012-3425"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=813249","reference_id":"813249","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=813249"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3425","reference_id":"CVE-2012-3425","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3425"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2012-3425"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nyc6-h81f-rqav"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38089?format=json","vulnerability_id":"VCID-p2gz-v2eb-n3bs","summary":"Out-of-bounds Read\nInteger underflow in the png_check_keyword function in pngwutil.c in libpng  allows remote attackers to have unspecified impact via a space character as a keyword in a PNG image, which triggers an out-of-bounds read.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8540.json","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-8540.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8540","reference_id":"","reference_type":"","scores":[{"value":"0.13549","scoring_system":"epss","scoring_elements":"0.9436","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2015-8540"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8472"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8540","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8540"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1291312","reference_id":"1291312","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1291312"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8540","reference_id":"CVE-2015-8540","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8540"},{"reference_url":"https://security.gentoo.org/glsa/201611-08","reference_id":"GLSA-201611-08","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201611-08"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0099","reference_id":"RHSA-2016:0099","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0099"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0100","reference_id":"RHSA-2016:0100","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0100"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:0101","reference_id":"RHSA-2016:0101","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:0101"},{"reference_url":"https://access.redhat.com/errata/RHSA-2016:1430","reference_id":"RHSA-2016:1430","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2016:1430"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2015-8540"],"risk_score":3.4,"exploitability":"0.5","weighted_severity":"6.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-p2gz-v2eb-n3bs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37789?format=json","vulnerability_id":"VCID-vd75-tvxc-9bah","summary":"Improper Restriction of Operations within the Bounds of a Memory Buffer\nHeap-based buffer overflow in the png_combine_row function in libpng, when running on systems, might allow context-dependent attackers to execute arbitrary code via a \"very wide interlaced\" PNG image.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-9495.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-9495.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-9495","reference_id":"","reference_type":"","scores":[{"value":"0.03487","scoring_system":"epss","scoring_elements":"0.87796","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-9495"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179186","reference_id":"1179186","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179186"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773823","reference_id":"773823","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773823"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773824","reference_id":"773824","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773824"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9495","reference_id":"CVE-2014-9495","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9495"},{"reference_url":"https://security.gentoo.org/glsa/201502-10","reference_id":"GLSA-201502-10","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201502-10"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2014-9495"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vd75-tvxc-9bah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37678?format=json","vulnerability_id":"VCID-yfe1-js79-y3hv","summary":"Uncontrolled Resource Consumption\nMultiple integer overflows in libpng rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-7354.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-7354.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2013-7354","reference_id":"","reference_type":"","scores":[{"value":"0.00567","scoring_system":"epss","scoring_elements":"0.68877","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2013-7354"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086516","reference_id":"1086516","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1086516"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7354","reference_id":"CVE-2013-7354","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7354"},{"reference_url":"https://security.gentoo.org/glsa/201408-06","reference_id":"GLSA-201408-06","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201408-06"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51199?format=json","purl":"pkg:nuget/libpng@1.6.18.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-fmt1-496f-9qf3"},{"vulnerability":"VCID-y21n-ekwz-ayep"},{"vulnerability":"VCID-yk3y-m6rn-ukbd"},{"vulnerability":"VCID-z7uy-uene-gkb8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}],"aliases":["CVE-2013-7354"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yfe1-js79-y3hv"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:nuget/libpng@1.6.18.1"}