Oracle Java SE 7u221/8u212/11.0.3/12.0.1 libpng use after free

Summaryinfo

A vulnerability, which was classified as critical, has been found in Oracle Java SE 7u221/8u212/11.0.3/12.0.1. This affects an unknown part of the component libpng. The manipulation leads to use after free. This vulnerability is documented as CVE-2019-7317. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Oracle Java SE 7u221/8u212/11.0.3/12.0.1 (Programming Language Software). It has been rated as critical. This issue affects an unknown functionality of the component libpng. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is integrity, and availability. The summary by CVE is:

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

The bug was discovered 02/01/2019. The weakness was released 07/16/2019 as Oracle Critical Patch Update Advisory - Juli 2019 as confirmed advisory (Website). The advisory is shared at oracle.com. The identification of this vulnerability is CVE-2019-7317 since 02/04/2019. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/06/2024). It is expected to see the exploit prices for this product decreasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 165 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371797 (Mozilla Firefox Multiple Security Vulnerabilities (MFSA 2019-13,MFSA2019-14)).

Upgrading eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Entries connected to this vulnerability are available at VDB-130484, VDB-137972, VDB-137963 and VDB-137964. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• Java SE

Version

• 7u221
• 8u212
• 11.0.3
• 12.0.1

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion