Libpng Updates Fix 21-Year-Old Null Dereference Bug
Written by Michael Larabel in Free Software on 29 December 2016 at 12:22 PM EST. 29 Comments
Libpng 1.6.27, 1.5.28, 1.4.20, 1.2.57, and 1.0.67 were all released today to fix a pointer null dereference bug dating back to 1995.

From the mailing list announcement:
These all fix a potential "NULL dereference" bug that has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened.

Great to see that bug being discovered and fixed after 21 years. There are also a few other minor updates to find with libpng 1.6.27.

Here's to hoping for more open-source/Linux security and bug-fixing improvements in 2017!
Related News
About The Author
Author picture

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter or contacted via

Popular News This Week