PatchTheCVEpngcrush vulnerabilities and fixes
Recent CVEs affecting pngcrush, with upgrade or downgrade steps. 2 tracked.
pngcrush has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2017-10-06. Highest priority: CVE-2015-7700 (score 60/100).
- CVE-2015-7700 CRITICAL 9.8 UPGRADE Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to
- CVE-2015-2158 HIGH 7.8 UPGRADE Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote a
FAQ
How do I fix pngcrush vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pngcrush being exploited right now?
None of the tracked pngcrush CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pngcrush CVE should I patch first?
CVE-2015-7700 currently ranks highest (60/100): Double-free vulnerability in the sPLT chunk structure and png.c in pngcrush before 1.7.87 allows attackers to .