{"id":"CLSA-2026-1777552532","summary":"Fix CVE(s): CVE-2025-64720, CVE-2025-65018","details":"   * No-source-change rebuild against libpng (\u003e= 1.6.37-2+tuxcare.els2) to\n     pick up the libpng security fixes for:\n     - CVE-2025-64720: png_image_read_composite OOB read on palette images\n       with PNG_FLAG_OPTIMIZE_ALPHA (libpng \u003c 1.6.51).\n     - CVE-2025-65018: png_image_finish_read heap buffer overflow on 16-bit\n       interlaced PNGs with 8-bit output (libpng \u003c 1.6.51).\n     Both vulnerabilities live entirely in libpng (used in OpenJDK only via\n     the system libpng linked into libsplashscreen / AWT image decoding via\n     libsplashscreen --with-libpng=system); no OpenJDK source change is\n     required. The fix is delivered by the libpng rebuild\n     (build 69ef31c7922f4d8bf30fd637, libpng1.6 1.6.37-2+tuxcare.els2).\n     Bumping the Build-Depends floor on libpng-dev guarantees the fixed\n     headers/library are linked in this rebuild.","modified":"2026-06-04T09:47:35.535849839Z","published":"2026-04-30T12:35:45Z","upstream":["CVE-2025-64720","CVE-2025-65018"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1777552532.html"}],"affected":[{"package":{"name":"openjdk-11-demo","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-11-demo?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.30+7-0ubuntu1~20.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json"}},{"package":{"name":"openjdk-11-doc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-11-doc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.30+7-0ubuntu1~20.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json"}},{"package":{"name":"openjdk-11-jdk","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-11-jdk?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.30+7-0ubuntu1~20.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json"}},{"package":{"name":"openjdk-11-jdk-headless","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-11-jdk-headless?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.30+7-0ubuntu1~20.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json"}},{"package":{"name":"openjdk-11-jre","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-11-jre?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.30+7-0ubuntu1~20.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json"}},{"package":{"name":"openjdk-11-jre-headless","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-11-jre-headless?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.30+7-0ubuntu1~20.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json"}},{"package":{"name":"openjdk-11-jre-zero","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-11-jre-zero?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.30+7-0ubuntu1~20.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json"}},{"package":{"name":"openjdk-11-source","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openjdk-11-source?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.30+7-0ubuntu1~20.04+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1777552532.json"}}],"schema_version":"1.7.5"}