libpng security issue that affects TeX Live 2026
"Nelson H. F. Beebe" <[email protected]> Tue, 17 Feb 2026 15:12:19 -0700
| Newsgroups | gmane.comp.tex.live |
|---|---|
| Message-ID | <[email protected]> |
There is a new security bulletin for libpng (see below). From our TeX Live 2026 progress report site at https://www.math.utah.edu/pub/texlive-utah-2026/ these executables depend on that library: libpng16 xelatex xelatex-dev xetex However, a "grep -l libpng *" on the binaries in the x86_64-ubuntu2604 tree finds 56 executables that contain the string "libpng", which perhaps means that they use that library, but do so via dynamic linking, rather than having -lpng bound to the executable at link time. Alternatively, they may be statically linked with -lpng, and thus, might contain vulnerable code. Before I do builds on the various systems reported on at the above site, I generally run system updates, and if needed, reboot the build host(s). Here is the Debian security advisory that just appeared: >> ... >> - ------------------------------------------------------------------------- >> Debian Security Advisory DSA-6138-1 [email protected] >> https://www.debian.org/security/ Moritz Muehlenhoff >> February 17, 2026 https://www.debian.org/security/faq >> - ------------------------------------------------------------------------- >> >> Package : libpng1.6 >> CVE ID : CVE-2026-25646 >> >> A buffer overflow was discovered in libpng, a library implementing an >> interface for reading and writing PNG (Portable Network Graphics) files, >> which could result in denial of service or potentially the execution >> of arbitrary code. >> >> For the oldstable distribution (bookworm), this problem has been fixed >> in version 1.6.39-2+deb12u3. This update also includes two additional >> security fixes (CVE-2026-22801 and CVE-2026-22695), which had been >> lined up for the next Bookworm point release. >> >> For the stable distribution (trixie), this problem has been fixed in >> version 1.6.48-1+deb13u3. This update also includes two additional >> security fixes (CVE-2026-22801 and CVE-2026-22695), which had been >> lined up for the next Trixie point release. >> >> We recommend that you upgrade your libpng1.6 packages. >> >> For the detailed security status of libpng1.6 please refer to >> its security tracker page at: >> https://security-tracker.debian.org/tracker/libpng1.6 >> >> Further information about Debian Security Advisories, how to apply >> these updates to your system and frequently asked questions can be >> found at: https://www.debian.org/security/ >> >> Mailing list: [email protected] >> ... ------------------------------------------------------------------------------- - Nelson H. F. Beebe Tel: +1 801 581 5254 - - University of Utah - - Department of Mathematics, 110 LCB Internet e-mail: [email protected] - - 155 S 1400 E RM 233 [email protected] [email protected] - - Salt Lake City, UT 84112-0090, USA URL: https://www.math.utah.edu/~beebe - -------------------------------------------------------------------------------