libpng 1.6.51 (the most critical update in decades) released!

--===============3859884845794119919==
Content-Type: multipart/alternative; boundary="000000000000ec9afd0644433296"

--000000000000ec9afd0644433296
Content-Type: text/plain; charset="UTF-8"

Dear community of PNG and libpng users,

Two days ago I released libpng-1.6.51. Let's call it the most critical
libpng release in decades, because it is. This was unexpected in the sense
that we had a rather long streak of releases free of any urgent security
fixes, yet it was expected in the sense that we had several
security-sensitive issues open for months with no apparent opportunity for
us to make progress.

Enter Artiphishell, a fine company who has kindly contributed their efforts
and their technology to get the ball rolling. Thank you so much, guys!

To make the long story short (because the long-story-medium-sized is
already available at
https://github.com/pnggroup/libpng/blob/v1.6.51/ANNOUNCE and
https://www.openwall.com/lists/oss-security/2025/11/22/1), we just fixed
two high-severity vulnerabilities PLUS two medium-severity vulnerabilities
PLUS a memory leak. If you process untrusted PNG images with the simplified
libpng API, and/or if you read untrusted truecolor PNG images and quantize
them to 256 colors or less using any libpng API, then you absolutely need
this update. I mean, exclamation mark!

The CVE IDs are CVE-2025-64505, CVE-2025-64506, CVE-2025-64720 and
CVE-2025-65018, for those keeping score. The gory details are available at
https://github.com/pnggroup/libpng/security/advisories/

Many thanks to the reporters (their GitHub usernames are @Samsung-PENTEST,
@weijinjinnihao and @yosiimich); and just as many thanks to those who
helped with triaging and analysis (Artiphishell's Fabio Gritti and our own
John Bowler).

There are improvements of the business-as-usual kind in this new libpng
version as well. Filip Wasil improved the RISC-V SIMD (RVV) support and
raised the bar of the minimum required version to RVV 1.0 or newer. Tobias
Stoeckmann helped us get rid of technical debt by removing the inchoate
support for ERROR_NUMBERS (a very old, never-enabled, never-completed
feature).

Oh, and... "one more thing": many thanks to Greg Roelofs for his continuing
maintenance of the libpng website in general, and for coordinating the
updates on the spot for this release in particular.

Moving on, I will merge all of these new 1.6.51 additions into the draft
libpng-1.8.x line and into the draftier libpng-2.x line. And then, we will
resume the work on the grand libpng-1.8.0 release.

---

In the good old tradition of file authentication, here are the SHA-2-256
checksums of the published archive files:

libpng-1.6.51.tar.gz
ac25cafc2054cda3f6f0fe22ee9fc587024b99e01d03bd72b765824e48f39021

libpng-1.6.51.tar.xz
a050a892d3b4a7bb010c3a95c7301e49656d72a64f1fc709a90b8aded192bed2

lpng1651.7z
598246281b31494c47f22c74d6c35330d08f74d0a3b19eb33b53fd79b4897a87

lpng1651.zip
31c2c6505fc1bb613574fd12357684b4e0292650607416ef1e68e6e4e0c470c8

---

Sincerely,
Cosmin

--000000000000ec9afd0644433296
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Dear community of PNG and libpng users,<br><br>Two days ag=
o I released libpng-1.6.51. Let&#39;s call it the most critical libpng rele=
ase in decades, because it is. This was unexpected in the sense that we had=
 a rather long streak of releases free of any urgent security fixes, yet it=
 was expected in the sense that we had several security-sensitive issues op=
en for months with no apparent opportunity for us to make progress.<br><br>=
Enter Artiphishell, a fine company who has kindly contributed their efforts=
 and their technology to get the ball rolling. Thank you so much, guys!<br>=
<br>To make the long story short (because the long-story-medium-sized is al=
ready available at <a href=3D"https://github.com/pnggroup/libpng/blob/v1.6.=
51/ANNOUNCE">https://github.com/pnggroup/libpng/blob/v1.6.51/ANNOUNCE</a> a=
nd <a href=3D"https://www.openwall.com/lists/oss-security/2025/11/22/1">htt=
ps://www.openwall.com/lists/oss-security/2025/11/22/1</a>), we just fixed t=
wo high-severity vulnerabilities PLUS two medium-severity vulnerabilities P=
LUS a memory leak. If you process untrusted PNG images with the simplified =
libpng API, and/or if you read untrusted truecolor PNG images and quantize =
them to 256 colors or less using any libpng API, then you absolutely need t=
his update. I mean, exclamation mark!<br><br>The CVE IDs are CVE-2025-64505=
, CVE-2025-64506, CVE-2025-64720 and CVE-2025-65018, for those keeping scor=
e. The gory details are available at<br><a href=3D"https://github.com/pnggr=
oup/libpng/security/advisories/">https://github.com/pnggroup/libpng/securit=
y/advisories/</a><br><br>Many thanks to the reporters (their GitHub usernam=
es are @Samsung-PENTEST, @weijinjinnihao and @yosiimich); and just as many =
thanks to those who helped with triaging and analysis (Artiphishell&#39;s F=
abio Gritti and our own John Bowler).<br><br>There are improvements of the =
business-as-usual kind in this new libpng version as well. Filip Wasil impr=
oved the RISC-V SIMD (RVV) support and raised the bar of the minimum requir=
ed version to RVV 1.0 or newer. Tobias Stoeckmann helped us get rid of tech=
nical debt by removing the inchoate support for ERROR_NUMBERS (a very old, =
never-enabled, never-completed feature).<br><br>Oh, and... &quot;one more t=
hing&quot;: many thanks to Greg Roelofs for his continuing maintenance of t=
he libpng website in general, and for coordinating the updates on the spot =
for this release in particular.<br><br>Moving on, I will merge all of these=
 new 1.6.51 additions into the draft libpng-1.8.x line and into the draftie=
r libpng-2.x line. And then, we will resume the work on the grand libpng-1.=
8.0 release.<br><br>---<br><br>In the good old tradition of file authentica=
tion, here are the SHA-2-256 checksums of the published archive files:<br><=
br>libpng-1.6.51.tar.gz<br>ac25cafc2054cda3f6f0fe22ee9fc587024b99e01d03bd72=
b765824e48f39021<br><br>libpng-1.6.51.tar.xz<br>a050a892d3b4a7bb010c3a95c73=
01e49656d72a64f1fc709a90b8aded192bed2<br><br>lpng1651.7z<br>598246281b31494=
c47f22c74d6c35330d08f74d0a3b19eb33b53fd79b4897a87<br><br>lpng1651.zip<br>31=
c2c6505fc1bb613574fd12357684b4e0292650607416ef1e68e6e4e0c470c8<br><br>---<b=
r><br>Sincerely,<br>Cosmin<br><br></div>

--000000000000ec9afd0644433296--


--===============3859884845794119919==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============3859884845794119919==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
png-mng-implement mailing list
png-mng-implement-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/png-mng-implement

--===============3859884845794119919==--