Read the docs
TI-2015-06751 Aliases CVE-2015-8126GHSA-rr6q-q2jh-948f

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in…

Priority MEDIUM 45CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 39 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-120 and the CVSS impact.

Summary

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.10339 95th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 39 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 58

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*before 1.0.64; 1.1.1 to before 1.2.54; 1.3.0 to before 1.4.17; 1.5.0 to before 1.5.24; 1.6.0 to before 1.6.19Vulnerablepnggroup
cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*21VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*22VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*23VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*42.1VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*13.1VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*13.2VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*11 sp3VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*11 sp4VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*12VulnerableSUSE
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions before 1.0.64; 1.1.1 to before 1.2.54; 1.3.0 to before 1.4.17; 1.5.0 to before 1.5.24; 1.6.0 to before 1.6.19 Vulnerable ·pnggroup
  • cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:* Versions 21 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* Versions 22 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:* Versions 23 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* Versions 42.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:* Versions 11 sp3 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:* Versions 11 sp4 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:* Versions 12 Vulnerable ·SUSE
Show 48 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:*12 sp1VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*12VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*12 sp1VulnerableSUSE
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*5.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:*6.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*5.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:a:oracle:jdk:1.6.0:update105:*:*:*:*:*:*1.6.0 update105VulnerableOracle
cpe:2.3:a:oracle:jdk:1.7.0:update91:*:*:*:*:*:*1.7.0 update91VulnerableOracle
cpe:2.3:a:oracle:jdk:1.8.0:update65:*:*:*:*:*:*1.8.0 update65VulnerableOracle
cpe:2.3:a:oracle:jdk:1.8.0:update66:*:*:*:*:*:*1.8.0 update66VulnerableOracle
cpe:2.3:a:oracle:jre:1.6.0:update105:*:*:*:*:*:*1.6.0 update105VulnerableOracle
cpe:2.3:a:oracle:jre:1.7.0:update91:*:*:*:*:*:*1.7.0 update91VulnerableOracle
cpe:2.3:a:oracle:jre:1.8.0:update65:*:*:*:*:*:*1.8.0 update65VulnerableOracle
cpe:2.3:a:oracle:jre:1.8.0:update66:*:*:*:*:*:*1.8.0 update66VulnerableOracle
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*6VulnerableOracle
cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*7VulnerableOracle
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*11.3VulnerableOracle
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*before 10.11.4VulnerableApple
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*15.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*15.10VulnerableCanonical
  • cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:* Versions 12 sp1 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:* Versions 12 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:* Versions 12 sp1 Vulnerable ·SUSE
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:* Versions 5.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.7:*:*:*:*:*:*:* Versions 6.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:* Versions 5.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:a:oracle:jdk:1.6.0:update105:*:*:*:*:*:* Versions 1.6.0 update105 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.7.0:update91:*:*:*:*:*:* Versions 1.7.0 update91 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.8.0:update65:*:*:*:*:*:* Versions 1.8.0 update65 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.8.0:update66:*:*:*:*:*:* Versions 1.8.0 update66 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jre:1.6.0:update105:*:*:*:*:*:* Versions 1.6.0 update105 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jre:1.7.0:update91:*:*:*:*:*:* Versions 1.7.0 update91 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jre:1.8.0:update65:*:*:*:*:*:* Versions 1.8.0 update65 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jre:1.8.0:update66:*:*:*:*:*:* Versions 1.8.0 update66 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* Versions 6 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:* Versions 7 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:* Versions 11.3 Vulnerable ·Oracle
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions before 10.11.4 Vulnerable ·Apple
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* Versions 15.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:* Versions 15.10 Vulnerable ·Canonical

Remediation

Red Hat 11 advisories

  • RHSA-2016:1430 Released 2016-07-18 · Red Hat rating Moderate
    java-1.7.0-ibm and java-1.7.1-ibm security update
    • Red Hat Satellite 5.6 (RHEL v.5) java-1.7.0-ibm-1:1.7.0.9.40-1jpp.1.el5, java-1.7.0-ibm-devel-1:1.7.0.9.40-1jpp.1.el5, spacewalk-java-2.0.2-109.el5sat +5
    • Red Hat Satellite 5.6 (RHEL v.6) java-1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7, java-1.7.1-ibm-devel-1:1.7.1.3.40-1jpp.1.el6_7, spacewalk-java-2.0.2-109.el6sat +5
    • Red Hat Satellite 5.7 (RHEL v.6) java-1.7.1-ibm-1:1.7.1.3.40-1jpp.1.el6_7, java-1.7.1-ibm-devel-1:1.7.1.3.40-1jpp.1.el6_7, spacewalk-java-2.3.8-146.el6sat +5
  • RHSA-2016:0099 Released 2016-02-02 · Red Hat rating Critical
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.3.30-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.3.30-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-demo-1:1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-devel-1:1.7.1.3.30-1jpp.2.el6_7 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-demo-1:1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-devel-1:1.7.1.3.30-1jpp.2.el6_7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-demo-1:1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-devel-1:1.7.1.3.30-1jpp.2.el6_7 +3
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7.ppc, java-1.7.1-ibm-demo-1:1.7.1.3.30-1jpp.1.el7 +6
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-demo-1:1.7.1.3.30-1jpp.2.el6_7, java-1.7.1-ibm-devel-1:1.7.1.3.30-1jpp.2.el6_7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.3.30-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.3.30-1jpp.1.el7 +3
  • RHSA-2016:0098 Released 2016-02-02 · Red Hat rating Critical
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.2.10-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.2.10-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.2.10-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.2.10-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.2.10-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.2.10-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.2.10-1jpp.1.el7, java-1.8.0-ibm-1:1.8.0.2.10-1jpp.1.el7.ppc, java-1.8.0-ibm-demo-1:1.8.0.2.10-1jpp.1.el7 +5
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.2.10-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.2.10-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.2.10-1jpp.1.el7 +3
Show 8 more Red Hat advisories
  • RHSA-2016:0100 Released 2016-02-02 · Red Hat rating Critical
    java-1.7.0-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5, java-1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5.i386, java-1.7.0-ibm-demo-1:1.7.0.9.30-1jpp.1.el5 +9
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5, java-1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5.i386, java-1.7.0-ibm-1:1.7.0.9.30-1jpp.1.el5.ppc +15
  • RHSA-2016:0101 Released 2016-02-02 · Red Hat rating Critical
    java-1.6.0-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.16.20-1jpp.1.el5 +13
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-demo-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-devel-1:1.6.0.16.20-1jpp.1.el6_7 +4
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-demo-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-devel-1:1.6.0.16.20-1jpp.1.el6_7 +2
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5.i386, java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el5.ppc +21
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-demo-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-devel-1:1.6.0.16.20-1jpp.1.el6_7 +4
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-demo-1:1.6.0.16.20-1jpp.1.el6_7, java-1.6.0-ibm-devel-1:1.6.0.16.20-1jpp.1.el6_7 +4
  • RHSA-2016:0055 Released 2016-01-21 · Red Hat rating Critical
    java-1.8.0-oracle security update
    • Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el7, java-1.8.0-oracle-devel-1:1.8.0.71-1jpp.1.el7, java-1.8.0-oracle-javafx-1:1.8.0.71-1jpp.1.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el7, java-1.8.0-oracle-devel-1:1.8.0.71-1jpp.1.el7, java-1.8.0-oracle-javafx-1:1.8.0.71-1jpp.1.el7 +1
    • Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el6_7, java-1.8.0-oracle-devel-1:1.8.0.71-1jpp.1.el6_7, java-1.8.0-oracle-javafx-1:1.8.0.71-1jpp.1.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el6_7, java-1.8.0-oracle-devel-1:1.8.0.71-1jpp.1.el6_7, java-1.8.0-oracle-javafx-1:1.8.0.71-1jpp.1.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el7, java-1.8.0-oracle-devel-1:1.8.0.71-1jpp.1.el7, java-1.8.0-oracle-javafx-1:1.8.0.71-1jpp.1.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Server 6 java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el6_7, java-1.8.0-oracle-devel-1:1.8.0.71-1jpp.1.el6_7, java-1.8.0-oracle-javafx-1:1.8.0.71-1jpp.1.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el6_7, java-1.8.0-oracle-devel-1:1.8.0.71-1jpp.1.el6_7, java-1.8.0-oracle-javafx-1:1.8.0.71-1jpp.1.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.8.0-oracle-1:1.8.0.71-1jpp.1.el7, java-1.8.0-oracle-devel-1:1.8.0.71-1jpp.1.el7, java-1.8.0-oracle-javafx-1:1.8.0.71-1jpp.1.el7 +3
  • RHSA-2016:0056 Released 2016-01-21 · Red Hat rating Critical
    java-1.7.0-oracle security update
    • Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.7.0-oracle-1:1.7.0.95-1jpp.2.el7, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.2.el7, java-1.7.0-oracle-javafx-1:1.7.0.95-1jpp.2.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Client 5 java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el5_11.i586, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.1.el5_11 +9
    • Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.7.0-oracle-1:1.7.0.95-1jpp.2.el7, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.2.el7, java-1.7.0-oracle-javafx-1:1.7.0.95-1jpp.2.el7 +1
    • Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el6_7, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.1.el6_7, java-1.7.0-oracle-javafx-1:1.7.0.95-1jpp.1.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el6_7, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.1.el6_7, java-1.7.0-oracle-javafx-1:1.7.0.95-1jpp.1.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.7.0-oracle-1:1.7.0.95-1jpp.2.el7, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.2.el7, java-1.7.0-oracle-javafx-1:1.7.0.95-1jpp.2.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Server 5 java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el5_11, java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el5_11.i586, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.1.el5_11 +9
    • Oracle Java for Red Hat Enterprise Linux Server 6 java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el6_7, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.1.el6_7, java-1.7.0-oracle-javafx-1:1.7.0.95-1jpp.1.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation java-1.7.0-oracle-1:1.7.0.95-1jpp.1.el6_7, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.1.el6_7, java-1.7.0-oracle-javafx-1:1.7.0.95-1jpp.1.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.7.0-oracle-1:1.7.0.95-1jpp.2.el7, java-1.7.0-oracle-devel-1:1.7.0.95-1jpp.2.el7, java-1.7.0-oracle-javafx-1:1.7.0.95-1jpp.2.el7 +3
  • RHSA-2016:0057 Released 2016-01-21 · Red Hat rating Important
    java-1.6.0-sun security update
    • Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.6.0-sun-1:1.6.0.111-1jpp.1.el7, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.1.el7, java-1.6.0-sun-devel-1:1.6.0.111-1jpp.1.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Client 5 java-1.6.0-sun-1:1.6.0.111-1jpp.3.el5_11, java-1.6.0-sun-1:1.6.0.111-1jpp.3.el5_11.i586, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.3.el5_11 +9
    • Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.6.0-sun-1:1.6.0.111-1jpp.1.el7, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.1.el7, java-1.6.0-sun-devel-1:1.6.0.111-1jpp.1.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.6.0-sun-1:1.6.0.111-1jpp.3.el6_7, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.3.el6_7, java-1.6.0-sun-devel-1:1.6.0.111-1jpp.3.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.6.0-sun-1:1.6.0.111-1jpp.3.el6_7, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.3.el6_7, java-1.6.0-sun-devel-1:1.6.0.111-1jpp.3.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.6.0-sun-1:1.6.0.111-1jpp.1.el7, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.1.el7, java-1.6.0-sun-devel-1:1.6.0.111-1jpp.1.el7 +3
    • Oracle Java for Red Hat Enterprise Linux Server 5 java-1.6.0-sun-1:1.6.0.111-1jpp.3.el5_11, java-1.6.0-sun-1:1.6.0.111-1jpp.3.el5_11.i586, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.3.el5_11 +9
    • Oracle Java for Red Hat Enterprise Linux Server 6 java-1.6.0-sun-1:1.6.0.111-1jpp.3.el6_7, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.3.el6_7, java-1.6.0-sun-devel-1:1.6.0.111-1jpp.3.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation java-1.6.0-sun-1:1.6.0.111-1jpp.3.el6_7, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.3.el6_7, java-1.6.0-sun-devel-1:1.6.0.111-1jpp.3.el6_7 +3
    • Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.6.0-sun-1:1.6.0.111-1jpp.1.el7, java-1.6.0-sun-demo-1:1.6.0.111-1jpp.1.el7, java-1.6.0-sun-devel-1:1.6.0.111-1jpp.1.el7 +3
  • RHSA-2015:2595 Released 2015-12-09 · Red Hat rating Moderate
    libpng12 security update
    • Red Hat Enterprise Linux Client (v. 7) libpng12-1.2.50-7.el7_2
    • Red Hat Enterprise Linux Client Optional (v. 7) libpng12-devel-1.2.50-7.el7_2
    • Red Hat Enterprise Linux ComputeNode (v. 7) libpng12-1.2.50-7.el7_2
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libpng12-devel-1.2.50-7.el7_2
    • Red Hat Enterprise Linux Server (v. 7) libpng12-1.2.50-7.el7_2, libpng12-1.2.50-7.el7_2.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7) libpng12-devel-1.2.50-7.el7_2, libpng12-devel-1.2.50-7.el7_2.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) libpng12-1.2.50-7.el7_2
    • Red Hat Enterprise Linux Workstation Optional (v. 7) libpng12-devel-1.2.50-7.el7_2
  • RHSA-2015:2596 Released 2015-12-09 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux Client (v. 7) libpng-2:1.5.13-7.el7_2
    • Red Hat Enterprise Linux Client Optional (v. 7) libpng-devel-2:1.5.13-7.el7_2, libpng-static-2:1.5.13-7.el7_2
    • Red Hat Enterprise Linux ComputeNode (v. 7) libpng-2:1.5.13-7.el7_2
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libpng-devel-2:1.5.13-7.el7_2, libpng-static-2:1.5.13-7.el7_2
    • Red Hat Enterprise Linux Server (v. 7) libpng-2:1.5.13-7.el7_2, libpng-2:1.5.13-7.el7_2.ppc, libpng-devel-2:1.5.13-7.el7_2 +1
    • Red Hat Enterprise Linux Server Optional (v. 7) libpng-static-2:1.5.13-7.el7_2, libpng-static-2:1.5.13-7.el7_2.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) libpng-2:1.5.13-7.el7_2, libpng-devel-2:1.5.13-7.el7_2
    • Red Hat Enterprise Linux Workstation Optional (v. 7) libpng-static-2:1.5.13-7.el7_2
  • RHSA-2015:2594 Released 2015-12-09 · Red Hat rating Moderate
    libpng security update
    • Red Hat Enterprise Linux Desktop (v. 6) libpng-2:1.2.49-2.el6_7
    • Red Hat Enterprise Linux Desktop Optional (v. 6) libpng-devel-2:1.2.49-2.el6_7, libpng-static-2:1.2.49-2.el6_7
    • Red Hat Enterprise Linux HPC Node (v. 6) libpng-2:1.2.49-2.el6_7
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) libpng-devel-2:1.2.49-2.el6_7, libpng-static-2:1.2.49-2.el6_7
    • Red Hat Enterprise Linux Server (v. 6) libpng-2:1.2.49-2.el6_7, libpng-2:1.2.49-2.el6_7.ppc, libpng-devel-2:1.2.49-2.el6_7 +1
    • Red Hat Enterprise Linux Server Optional (v. 6) libpng-static-2:1.2.49-2.el6_7
    • Red Hat Enterprise Linux Workstation (v. 6) libpng-2:1.2.49-2.el6_7, libpng-devel-2:1.2.49-2.el6_7
    • Red Hat Enterprise Linux Workstation Optional (v. 6) libpng-static-2:1.2.49-2.el6_7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Oracle Java for Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2016:0055, RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux Client 5Fixed RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7)Fixed RHSA-2016:0055, RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux Desktop 6Fixed RHSA-2016:0055, RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux HPC Node 6Fixed RHSA-2016:0055, RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2016:0055, RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux Server 5Fixed RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux Server 6Fixed RHSA-2016:0055, RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux WorkstationFixed RHSA-2016:0055, RHSA-2016:0056, RHSA-2016:0057
Oracle Java for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2016:0055, RHSA-2016:0056, RHSA-2016:0057
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2015:2595, RHSA-2015:2596
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2015:2595, RHSA-2015:2596
Red Hat Enterprise Linux Client Supplementary (v. 7)Fixed RHSA-2016:0098, RHSA-2016:0099
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2015:2595, RHSA-2015:2596
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2015:2595, RHSA-2015:2596
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)Fixed RHSA-2016:0098, RHSA-2016:0099
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2015:2594
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2015:2594
Red Hat Enterprise Linux Desktop Supplementary (v. 5)Fixed RHSA-2016:0100, RHSA-2016:0101
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2016:0099, RHSA-2016:0101
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2015:2594
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2015:2594
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)Fixed RHSA-2016:0099, RHSA-2016:0101
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2015:2594
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2015:2595, RHSA-2015:2596
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2015:2594
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2015:2595, RHSA-2015:2596
Red Hat Enterprise Linux Server Supplementary (v. 5)Fixed RHSA-2016:0100, RHSA-2016:0101
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2016:0099, RHSA-2016:0101
Red Hat Enterprise Linux Server Supplementary (v. 7)Fixed RHSA-2016:0098, RHSA-2016:0099
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2015:2594
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2015:2595, RHSA-2015:2596
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2015:2594
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2015:2595, RHSA-2015:2596
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2016:0099, RHSA-2016:0101
Red Hat Enterprise Linux Workstation Supplementary (v. 7)Fixed RHSA-2016:0098, RHSA-2016:0099
Red Hat Satellite 5.6 (RHEL v.5)Fixed RHSA-2016:1430
Red Hat Satellite 5.6 (RHEL v.6)Fixed RHSA-2016:1430
Red Hat Satellite 5.7 (RHEL v.6)Fixed RHSA-2016:1430

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-8126
  2. 2026-10-03 Alias added: GHSA-rr6q-q2jh-948f
  3. 2026-10-15 CISA SSVC decision points changed

References

Patch 1

Advisory 53

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences