Read the docs
TI-2019-05205 Aliases CVE-2019-7317GHSA-m96g-x499-p5f9

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because…

Priority LOW 36CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 26 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.09393 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 12 advisoriesRed Hat: 26 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:*1.6.0 to before 1.6.37Vulnerablepnggroup
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*18.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.6.0:*:*:*:*:*:*:*11.2.6.0VulnerableOracle
cpe:2.3:a:oracle:java_se:7u221:*:*:*:*:*:*:*7u221VulnerableOracle
  • cpe:2.3:a:libpng:libpng:*:*:*:*:*:*:*:* Versions 1.6.0 to before 1.6.37 Vulnerable ·pnggroup
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:*:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
  • cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.2.6.0:*:*:*:*:*:*:* Versions 11.2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:java_se:7u221:*:*:*:*:*:*:* Versions 7u221 Vulnerable ·Oracle
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:java_se:8u212:*:*:*:*:*:*:*8u212VulnerableOracle
cpe:2.3:a:oracle:jdk:11.0.3:*:*:*:*:*:*:*11.0.3VulnerableOracle
cpe:2.3:a:oracle:jdk:12.0.1:*:*:*:*:*:*:*12.0.1VulnerableOracle
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*before 8.0.23VulnerableOracle
cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:*before 8.7.0-00VulnerableHewlett Packard Enterprise
cpe:2.3:a:hpe:xp7_command_view_advanced_edition_suite:*:*:*:*:*:*:*:*before 8.7.0-00VulnerableHewlett Packard Enterprise (HPE)
cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*not specified by NVDVulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:*not specified by NVDVulnerableMozilla
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*42.3VulnerableopenSUSE
cpe:2.3:a:opensuse:package_hub:-:*:*:*:*:*:*:*not specified by NVDVulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*12.0Running onSUSE
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*before 9.6VulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*before 9.6VulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:vmware_vsphere:*:*9.6VulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:windows:*:*9.6VulnerableNetApp
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:vcenter:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_storage_manager:*:*:*:*:*:*:*:*before 11.53VulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_unified_manager:*:*:*:*:*:*:*:*before 3.2VulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:*before 4.0VulnerableNetApp
cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:*before 7.3.9VulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:*before 5.1VulnerableNetApp
cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:*before 3.4.2VulnerableNetApp
cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*before 3.4.2VulnerableNetApp
cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:oracle:*:*3.4.2 p1VulnerableNetApp
cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:sap:*:*3.4.2 p1VulnerableNetApp
cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*5.8VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:oracle:java_se:8u212:*:*:*:*:*:*:* Versions 8u212 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:11.0.3:*:*:*:*:*:*:* Versions 11.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:12.0.1:*:*:*:*:*:*:* Versions 12.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* Versions before 8.0.23 Vulnerable ·Oracle
  • cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:* Versions before 8.7.0-00 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hpe:xp7_command_view_advanced_edition_suite:*:*:*:*:*:*:*:* Versions before 8.7.0-00 Vulnerable ·Hewlett Packard Enterprise (HPE)
  • cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Mozilla
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* Versions 42.3 Vulnerable ·openSUSE
  • cpe:2.3:a:opensuse:package_hub:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·SUSE
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions before 9.6 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions before 9.6 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:vmware_vsphere:*:* Versions 9.6 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:9.6:*:*:*:*:windows:*:* Versions 9.6 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:vcenter:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_storage_manager:*:*:*:*:*:*:*:* Versions before 11.53 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_unified_manager:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:* Versions before 4.0 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:* Versions before 7.3.9 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:* Versions before 5.1 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:* Versions before 3.4.2 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:* Versions before 3.4.2 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:oracle:*:* Versions 3.4.2 p1 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapmanager:3.4.2:p1:*:*:*:sap:*:* Versions 3.4.2 p1 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Red Hat 12 advisories

  • RHSA-2019:2737 Released 2019-09-11 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10
  • RHSA-2019:2592 Released 2019-09-03 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el6_10, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el6_10 +3
  • RHSA-2019:2590 Released 2019-09-02 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux 8 Supplementary java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0, java-1.8.0-ibm-demo-1:1.8.0.5.40-3.el8_0, java-1.8.0-ibm-devel-1:1.8.0.5.40-3.el8_0 +5
Show 9 more Red Hat advisories
  • RHSA-2019:2585 Released 2019-09-02 · Red Hat rating Important
    java-1.8.0-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-demo-1:1.8.0.5.40-1jpp.1.el7, java-1.8.0-ibm-devel-1:1.8.0.5.40-1jpp.1.el7 +3
  • RHSA-2019:2494 Released 2019-08-15 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el6_10, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el6_10 +3
  • RHSA-2019:2495 Released 2019-08-15 · Red Hat rating Important
    java-1.7.1-ibm security update
    • Red Hat Enterprise Linux Client Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7 +3
    • Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7 +1
    • Red Hat Enterprise Linux Server Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7 +3
    • Red Hat Enterprise Linux Workstation Supplementary (v. 7) java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-demo-1:1.7.1.4.50-1jpp.1.el7, java-1.7.1-ibm-devel-1:1.7.1.4.50-1jpp.1.el7 +3
  • RHSA-2019:1310 Released 2019-06-03 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux Desktop (v. 6) thunderbird-60.7.0-1.el6_10
    • Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-60.7.0-1.el6_10
    • Red Hat Enterprise Linux Workstation (v. 6) thunderbird-60.7.0-1.el6_10
  • RHSA-2019:1309 Released 2019-06-03 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux Client (v. 7) thunderbird-60.7.0-1.el7_6
    • Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-60.7.0-1.el7_6
    • Red Hat Enterprise Linux Workstation (v. 7) thunderbird-60.7.0-1.el7_6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) thunderbird-60.7.0-1.el7_6
  • RHSA-2019:1308 Released 2019-06-03 · Red Hat rating Important
    thunderbird security update
    • Red Hat Enterprise Linux AppStream (v. 8) thunderbird-60.7.0-1.el8_0
  • RHSA-2019:1269 Released 2019-05-23 · Red Hat rating Critical
    firefox security update
    • Red Hat Enterprise Linux AppStream (v. 8) firefox-60.7.0-1.el8_0
  • RHSA-2019:1267 Released 2019-05-23 · Red Hat rating Critical
    firefox security update
    • Red Hat Enterprise Linux Desktop (v. 6) firefox-60.7.0-1.el6_10
    • Red Hat Enterprise Linux Desktop Optional (v. 6) firefox-60.7.0-1.el6_10
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-60.7.0-1.el6_10
    • Red Hat Enterprise Linux Server (v. 6) firefox-60.7.0-1.el6_10
    • Red Hat Enterprise Linux Server Optional (v. 6) firefox-60.7.0-1.el6_10
    • Red Hat Enterprise Linux Workstation (v. 6) firefox-60.7.0-1.el6_10
    • Red Hat Enterprise Linux Workstation Optional (v. 6) firefox-60.7.0-1.el6_10
  • RHSA-2019:1265 Released 2019-05-23 · Red Hat rating Critical
    firefox security update
    • Red Hat Enterprise Linux Client (v. 7) firefox-60.7.0-1.el7_6
    • Red Hat Enterprise Linux Client Optional (v. 7) firefox-60.7.0-1.el7_6
    • Red Hat Enterprise Linux Server (v. 7) firefox-60.7.0-1.el7_6
    • Red Hat Enterprise Linux Server Optional (v. 7) firefox-60.7.0-1.el7_6
    • Red Hat Enterprise Linux Workstation (v. 7) firefox-60.7.0-1.el7_6
    • Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-60.7.0-1.el7_6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) firefox-60.7.0-1.el7_6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8 SupplementaryFixed RHSA-2019:2590
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:1269, RHSA-2019:1308
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2019:1265, RHSA-2019:1309
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2019:1265
Red Hat Enterprise Linux Client Supplementary (v. 7)Fixed RHSA-2019:2495, RHSA-2019:2585
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)Fixed RHSA-2019:2495, RHSA-2019:2585
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2019:1267, RHSA-2019:1310
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2019:1267
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2019:2494, RHSA-2019:2592
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2019:1267
Red Hat Enterprise Linux HPC Node Supplementary (v. 6)Fixed RHSA-2019:2494, RHSA-2019:2592
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:1267
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:1265
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2019:1267, RHSA-2019:1310
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2019:1265, RHSA-2019:1309
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2019:2494, RHSA-2019:2592
Red Hat Enterprise Linux Server Supplementary (v. 7)Fixed RHSA-2019:2495, RHSA-2019:2585
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:1267, RHSA-2019:1310
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:1265, RHSA-2019:1309
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2019:1267
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2019:1265
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2019:2494, RHSA-2019:2592
Red Hat Enterprise Linux Workstation Supplementary (v. 7)Fixed RHSA-2019:2495, RHSA-2019:2585
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2019:1265
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2019:1309
Red Hat Satellite 5.8 (RHEL v.6)Fixed RHSA-2019:2737
Not affected: 4 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-7317
  2. 2026-10-03 Alias added: GHSA-m96g-x499-p5f9

References

Exploit 1

Patch 1

Advisory 39

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences